ArtifactStart with the code
A generated artifact is a program, not a document.
A one-file dashboard, calculator, architecture map, or runbook can contain JavaScript. If that code executes on the same origin as an authenticated application, the browser may make the application's cookies, storage, DOM, and same-origin endpoints available to it. The source may look harmless and still contain accidental or deliberately hostile behavior.
ArtifactFlow therefore treats every pasted or uploaded HTML artifact as untrusted executable content. It does not declare arbitrary HTML safe after removing a few tags. Advisory scanning can identify obvious credentials and suspicious patterns, but isolation must still hold when scanning misses something.
Untrusted artifact bytes never execute in the authenticated application origin or its DOM. This applies to saved versions and to the preview shown before a page is saved.
Two origins
Identity and execution live in different browser boundaries.
App origin
Owns login, session cookies, CSRF protection, workspace authorization, editing, search, versions, audit, and issuance of tightly scoped preview grants. It never serves artifact HTML as an application document.
Artifact origin
Runs as a separate cookieless HTTP surface. It accepts only the saved-preview or draft-preview requests assigned to that runtime role and cannot expose login, dashboard, or management routes.
The production boot gate rejects overlapping origins and other incomplete boundary configuration. A real deployment needs two separate HTTPS hostnames; changing only a port on one cookie-bearing host is not the supported security model.
Browser enforcement
The iframe is intentionally capable and intentionally cut off.
Artifact JavaScript may run inside an opaque sandboxed iframe. The iframe does not receive allow-same-origin, top-navigation, popup, form, download, or pointer-lock powers. Response-header Content Security Policy denies ordinary subresources and connections with directives including default-src 'none', connect-src 'none', form-action 'none', and nested browsing-context restrictions.
The artifact response also limits who may embed it with frame-ancestors. Modern browser requests for artifact documents are expected to be iframe destinations, preventing the normal product flow from opening a signed artifact as an unsandboxed top-level tab.
Artifacts are therefore self-contained by design. CDN scripts, external styles, API calls, forms, workers, nested frames, and remote images are not product features to re-enable around the boundary.
Preview delivery
Saved and unsaved previews use different short-lived grants.
Saved versions
- The app origin authorizes the viewer and issues a short-lived HMAC-signed URL for a particular page version and preview purpose.
- The artifact origin verifies the signature, expiry, runtime role, and requested version before reading immutable bytes from private storage.
- If a running artifact later self-reloads after expiry, the authenticated parent can renew and replace only the iframe URL; the application document and unsaved editor state stay in place.
Draft previews
- An authenticated Editor asks the app origin for a capability tied to its purpose, artifact origin, workspace, nonce, exact UTF-8 byte length, and SHA-256 digest.
- The browser posts that capability and the exact draft directly into the cookieless artifact iframe.
- The artifact receiver verifies the short-lived capability, reflects the matching bytes once, and never persists the draft.
This avoids sending an unsaved draft through a public URL and avoids ever rendering it on the authenticated origin.
Defense in depth
Scanning and the injected guard help without becoming the boundary.
- Secret blockingPattern-based scanning rejects obvious credentials, private keys, JWTs, and provider-token patterns without persisting the matched secret. It is bypassable by obfuscation, and a clean scan is not proof that no secret was stored.
- Advisory findingsExpected artifact behavior such as inline JavaScript is recorded as a warning, not falsely certified as safe.
- Early document guardAn injected in-realm guard blocks common network, storage, popup, and nested-context APIs. Hostile code can tamper with same-realm JavaScript, so the guard is deliberately classified as defense in depth.
- Server hardeningStatic nested browsing-context markup is made inert before parsing, complementing CSP and browser-level regression tests for dynamic DOM APIs.
Provenance trust
A declared model is useful metadata, not a cryptographic proof.
ArtifactFlow separates facts it observed, including version, retained-byte hash, ingest actor, mechanism, and MCP client, from producer metadata supplied by a caller. MCP model claims are labelled self-reported. A client named Claude Code does not prove that Claude or any particular Opus release authored the content.
Provider/model search remains inside normal page authorization. External artifact or conversation links are HTTPS-only, never fetched by ArtifactFlow, excluded from logs, events, audit metadata, and search, and opened only after an authorized user chooses the escaped link. A valid destination can still be malicious or track the click.
A complete set of declared producer fields can still be self-reported and false. Hash equality proves only equality of the retained ArtifactFlow bytes, not the truth of the producer claim.
Honest residuals
Isolation narrows risk; it does not make hostile code benevolent.
A sandboxed iframe can still navigate itself to another site. Browser CSP does not provide a shipped directive that fully prevents that self-navigation. The isolated frame has no app cookies or other tenants' data to steal, but data a viewer is persuaded to type into an artifact, the viewer's IP address, and a view confirmation may still be exposed through navigation.
Browser behavior is not perfectly uniform. Chromium regression tests exercise the maintained attack corpus; Safari on macOS and iOS remains a documented manual release check. A legacy browser without modern sandbox protections is outside the intended trust envelope.
ArtifactFlow is a young 0.x internal-team tool. It has broad automated coverage and repeated AI-assisted adversarial review, but it has not received an independent third-party security audit. Pin a revision and read the full threat model before using it for important work.
Authoritative detail