10. A method comprising: receiving a plurality of documents for a web-based application, the web-based application comprising one or more of a plurality of custom components and one or more application programming interface (API) components; processing a document object model (DOM) corresponding to the web-based application, wherein the one or more custom components and the one or more API components are modeled in hierarchical form; and for each custom component: assigning a key to the custom component, the key constituting an object reference of the custom component such that the custom component is accessible only to other components capable of providing the key in accordance with one or more rules of capability security, identifying one or more accessible custom components for which the custom component is capable of providing a key assigned to the one or more accessible custom components, generating a virtual DOM for the custom component corresponding to the web-based application, wherein the custom component and the identified one or more accessible custom components are modeled in hierarchical form, and restricting access of the custom component to all inaccessible custom components for which the custom component is not capable of providing a key assigned to an inaccessible custom component.
10. A method comprising: receiving a plurality of documents for a web-based application, the web-based application comprising one or more of a plurality of custom components and one or more application programming interface (API) components; processing a document object model (DOM) corresponding to the web-based application, wherein the one or more custom components and the one or more API components are modeled in hierarchical form; and for each custom component: assigning a key to the custom component, the key constituting an object reference of the custom component such that the custom component is accessible only to other components capable of providing the key in accordance with one or more rules of capability security, identifying one or more accessible custom components for which the custom component is capable of providing a key assigned to the one or more accessible custom components, generating a virtual DOM for the custom component corresponding to the web-based application, wherein the custom component and the identified one or more accessible custom components are modeled in hierarchical form, and restricting access of the custom component to all inaccessible custom components for which the custom component is not capable of providing a key assigned to an inaccessible custom component. 12. The method of claim 10 , further comprising: for each API component, determining whether the API component is a private API component or a public API component; and for each custom component: restricting access of the custom component to all private API components.