It's a fair question. I need to better document the security features built into Fossil. Here is a quick off-the-top-of-my-head summary: (1) Fossil is design

It's a fair question. I need to better document the security features built into Fossil. Here is a quick off-the-top-of-my-head summary: (1) Fossil is designed to run inside a minimal chroot jail. The stand-alone "fossil" binary needs its repository database file, /dev/null, and /dev/random and nothing else. It can run inside a sparse jail. So even if somebody manages to find an RCE in Fossil, the damage potential is limited. They cannot shell-out because there is no /bin/sh in the jail. (2) Fossil processes each HTTP request in a separate process. (3) Custom static-analysis tools run over the Fossil sources at compile-time, and abort the built if any problems are seen. The source code and docs to these tools is in the Fossil source tree.