Is BAML "safe" in the sense that an untrusted BAML function definition would have limited scope? I would imagine any sufficiently rich template language could do denial of service, but I am wondering if there is a path to arbitrary code execution.

Baml function definition lives in your codebase so it shouldn't be untrusted unless you made some system to allow users to run Baml code. Denial of service is likely easy to do by simply passing large inputs to Baml functions and running out of memory, still your code passes parameters to Baml functions, so security layer is your code. Arbitrary code execution is not possible in principle, but hey all software can have vulnerabilities and the Baml runtime is no exception, though we are not aware of any vulnerability that allows arbitrary code execution right now, and if someone reports it we'll fix it

One extra vulnerability to think about with BAML is prompt injection. If your BAML function inputs include strings from users, then prompt injections are possible, and if your outputs include strings, it’s possible to exfiltrate data. Fortunately with BAML you have the tools to avoid both of these issues (avoid string fields)

I am imagining a service where I upload a BAML file and a bit later a Swagger/OpenAPI endpoint appears. Then I can integrate working prompt-as-function into other applications that don't have BAML per se, but are able to access external endpoints. If this is just for me then I don't have to worry about malicious BAML code but as a more open service it is maybe a question.

Ah, that’s the “untrusted BAML function”. Yes, you would definitely want to isolate the running of functions coming from different users somehow, because (even without template rendering, just with connections to LLM providers) it would be very easy for one user’s functions to eat unbounded resources.

Maybe such a server could be an open source project you have to host yourself on a cheap VPS and then worst case you blow up your own VPS.

For sure. baml-cli actually can do this for you (host BAML function endpoints on your server). There s just no “boundaryml cloud” yet allowing you to have us host

Oh wow, I didn't realize baml-cli already does exactly this with

baml-cli serve

. Thanks!