boxlang-application-descriptor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-application-descriptor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Application.bx is BoxLang's application descriptor. It defines application-level settings and lifecycle callbacks, and it is the cornerstone for running multiple isolated applications in one BoxLang server/runtime.
Use this skill whenever the question involves:
this.*boxlang.json) and app config (Application.bx)Application.bx.Application.bx is instantiated per request/execution context.application scope is persistent for that app name and survives across requests until timeout/stop.Each unique this.name maps to a unique application memory space:
application scopeThis enables running multiple apps side-by-side (public site, admin site, API site) in a single server process.
class {
this.name = "MyApp"
}Best practices:
this.name explicitly.If no name is provided, runtime may auto-generate one from the descriptor path for class listeners, which is usually not what you want in production.
Primary callbacks in Application.bx:
onApplicationStart()onApplicationEnd( applicationScope )onSessionStart()onSessionEnd( sessionScope, applicationScope )onRequestStart( targetPage )onRequest( targetPage )onRequestEnd()onError( exception, eventName )onMissingTemplate( targetPage )onAbort( targetPage )onClassRequest( className, method, args )class {
this.name = "MyApp"
this.sessionManagement = true
function onApplicationStart() {
application.bootedAt = now()
return true
}
function onRequestStart( string targetPage ) {
request.started = getTickCount()
return true
}
function onError( any exception, string eventName ) {
writeLog( text: "Error in #eventName#: #exception.message#", type: "Error" )
return true
}
}Common this.* settings in Application.bx include:
this.name, this.applicationTimeout, this.timezone, this.localethis.sessionManagement, this.sessionTimeout, this.sessionStoragethis.datasource, this.datasources, this.cachesthis.mappings, this.classPaths, this.javaSettingsthis.schedulers, this.watchersApplication.bx can wire async infrastructure per app:
class {
this.name = "MyApp"
this.schedulers = [
"schedulers.DailyMaintenance",
"schedulers.HourlyReports"
]
this.watchers = {
sourceWatcher : {
paths : [ expandPath( "./src" ) ],
listener : "app.listeners.HotReloadListener",
recursive : true,
debounce : 250,
atomicWrites : true,
errorThreshold : 10
}
}
}For deeper async details, see:
boxlang.json for runtime-wide defaults and infrastructure settings.Application.bx for app-specific behavior and overrides.Rule of thumb:
boxlang.jsonApplication.bxApplication.bx is being discovered by directory traversal.this.sessionManagement = true and web runtime context.this.applicationTimeout and applicationStop() usage.this.schedulers / this.watchers values and listener/class paths.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.