Security model
Keys, isolation, and what the bridge will and will not do.
Two kinds of key
Public keys ship in client code. They read published content for one environment. They cannot write, cannot read drafts without a preview token, and cannot see other environments.
Sessions are httpOnly cookies signed with AUTH_SECRET. Every write goes through one, with a role check per workspace.
Workspace isolation
Content is sharded across pod databases. The shard opener takes the workspace id and asserts it inside the query, not just in the routing table, so a bug in routing produces an error rather than another workspace's rows.
The editor bridge
The editor and the canvas run on different origins and exchange postMessage events. Both sides check event.origin against the workspace's registered editor origin. A page that loads the SDK cannot be driven by an arbitrary opener.
Content edited inline is sent as values, never as markup, and rich text is stored as a document rather than HTML: a javascript: link is refused at the editor and never reaches storage.
Roles
| Role | Can |
|---|---|
| Owner | everything, including billing and deleting the workspace |
| Admin | manage members, environments and settings |
| Editor | edit and publish |
| Author | edit and submit for review |
| Viewer | read |
All documentation · llms.txt · llms-full.txt · contentbind.com