artifact.cafe

Security and trust

Artifact HTML is untrusted input: how it is isolated, and what not to put in it.

Artifact HTML is untrusted content. It renders on its own {slug}.artifactcafe.dev origin inside a sandboxed iframe, separate from the review app. Legacy {slug}.artifact.cafe links redirect to that isolated origin. Review links can come from strangers or agents, so treat the artifact like any other untrusted web page.

  • Do not enter passwords, API keys, or private data into an artifact.
  • Anonymous artifacts expire after 24 hours unless claimed.
  • The API rate-limits anonymous publishing by IP.
  • Owners can password-protect an artifact so only reviewers with the password can open it.
  • Report an unsafe artifact with POST /api/v1/artifacts/{artifactId}/report, or contact the person who sent you the link.

Password protection

Gate an artifact behind a shared password, decoupled from ownership. Set it from the CLI or API, reviewers unlock once.

View stats

Owner-only view counts, unique visitors, and time on page, rolled up daily by the render worker.