From 5a43627714ebc50331b377f1cd911dc82628a52b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kat=20March=C3=A1n?= <kat.marchan@fastly.com>
Date: Mon, 31 Aug 2026 15:09:29 -0700
Subject: [PATCH] fix(includeBytes): additional documentation and test for
 particulars of behavior

---
 .../docs/experimental/includeBytes.mdx        |  2 ++
 integration-tests/js-compute/.hidden.txt      |  1 +
 .../js-compute/fixtures/app/.hidden.txt       |  1 +
 .../fixtures/app/src/include-bytes.js         | 20 +++++++++++++++++++
 4 files changed, 24 insertions(+)
 create mode 100644 integration-tests/js-compute/.hidden.txt
 create mode 100644 integration-tests/js-compute/fixtures/app/.hidden.txt

diff --git a/documentation/docs/experimental/includeBytes.mdx b/documentation/docs/experimental/includeBytes.mdx
index 9ec78512a6..1a2ddb9a58 100644
--- a/documentation/docs/experimental/includeBytes.mdx
+++ b/documentation/docs/experimental/includeBytes.mdx
@@ -10,6 +10,8 @@ The **`includeBytes()`** function is used embed a file as a Uint8Array.
 
 >**Note**: Can only be used during build-time initialization, not when processing requests.
 
+>**SECURITY**: `includeBytes()` is fully sandboxed to prevent access to files outside the directory that contains `fastly.toml`. All other files within that scope will be accessible, including through `..` and symlink navigation, including potentially sensitive files such as `.env`.
+
 ## Syntax
 
 ```js
diff --git a/integration-tests/js-compute/.hidden.txt b/integration-tests/js-compute/.hidden.txt
new file mode 100644
index 0000000000..2c13915354
--- /dev/null
+++ b/integration-tests/js-compute/.hidden.txt
@@ -0,0 +1 @@
+this is for the includeBytes sandbox test
diff --git a/integration-tests/js-compute/fixtures/app/.hidden.txt b/integration-tests/js-compute/fixtures/app/.hidden.txt
new file mode 100644
index 0000000000..a453e43b88
--- /dev/null
+++ b/integration-tests/js-compute/fixtures/app/.hidden.txt
@@ -0,0 +1 @@
+idk
diff --git a/integration-tests/js-compute/fixtures/app/src/include-bytes.js b/integration-tests/js-compute/fixtures/app/src/include-bytes.js
index d10dbda348..14ea136ffe 100644
--- a/integration-tests/js-compute/fixtures/app/src/include-bytes.js
+++ b/integration-tests/js-compute/fixtures/app/src/include-bytes.js
@@ -17,11 +17,31 @@ routes.set('/includeBytes', () => {
 });
 
 let nope = null;
+let dotfileNotOk = null;
+let dotfileOk = null;
 
 try {
   nope = includeBytes('../../../../README.md');
 } catch {}
 
+try {
+  dotfileOk = includeBytes('./.hidden.txt');
+} catch {}
+
+try {
+  dotfileNotOk = includeBytes('../../.hidden.txt');
+} catch {}
+
 routes.set('/includeBytes/sandbox', () => {
   assert(nope, null, 'includeBytes sandboxes its path to the project dir');
+  assert(
+    dotfileNotOk,
+    null,
+    'includeBytes sandboxes its path to the project dir',
+  );
+  assert(
+    Array.from(dotfileOk),
+    [105, 100, 107, 10],
+    'dotfile is included just fine',
+  );
 });