1. A system comprising: a processor; and a memory storing instructions that are configurable to cause the system to: receive a plurality of documents for a web-based application, the web-based application comprising one or more custom components and one or more API components; process a Document Object Model (DOM) corresponding to the web-based application, wherein the custom components and API components are modeled in hierarchical form; and for each custom component: assign a key to the custom component, the key constituting an object reference of the custom component such that custom components are accessible only to other components that can provide the key in accordance with the rules of capability security, identify one or more accessible custom components, wherein an accessible custom component is another custom component for which the custom component can provide the key assigned to the other custom component, generate a virtual DOM for the custom component corresponding to the web-based application, wherein the component and the identified accessible custom components are modeled in hierarchical form, and restrict access of the custom component to all inaccessible custom components, wherein an inaccessible custom component is another custom component for which the custom component cannot provide the key assigned to the other custom component.