Tauri 2

Apply the Rust 1.98 baseline first, including its toolchain and dependency rules. These rules cover Tauri 2 applications on desktop and mobile and were checked against 2.11.5; plugin rules apply only to installed v2 plugins and their supported platforms.

Version and trust boundary

• Resolve Tauri core, build helpers, CLI, JavaScript API, and plugins as compatible v2 components; their version numbers advance independently. Check the resolved dependency graph, not just the top-level tauri version, for security fixes, and upgrade each plugin's Rust crate and its @tauri-apps/plugin-* package together, because a plugin fix can need both. Read the security advisories on the tauri-apps/tauri and tauri-apps/plugins-workspace repositories on a schedule and before each release, because Tauri has published plugin advisories that reached no advisory database, so cargo audit and OSV-Scanner can't flag the affected releases.
• When application code decides whether a URL belongs to the app's own origin, compare the entire parsed host. On Windows and Android, Tauri serves app content from the host <scheme>.localhost, so a URL prefix check or a check on the first host label also accepts a remote host such as app.evil.com.
• Treat Rust commands and native plugin code as fully privileged within the application's OS permissions. Capability restrictions apply to exposed IPC operations; they do not sandbox Rust code or automatically constrain direct native API calls.

Commands and capabilities

• Register only necessary commands in tauri::generate_handler!. Configure