Each artifact has its own first-level hostname on the isolated content domain.
Untrusted HTML.
Very little trust.
An artifact is active code from someone else. Linkifact treats it that way: separate origin, restrictive browser sandbox, no outbound network, and no access to account state.
Defense in depth
The artifact gets a tiny browser-shaped box.
No single header carries the whole security model. Independent origin, iframe policy, response policy, and publication-time validation reinforce one another.
The content domain never receives Linkifact account cookies or browser storage.
Inline scripts work; network, frames, forms, workers, plugins, and navigation do not.
HTML policy and secret checks reject unsupported or high-risk content before storage.
V1 browser policy
Interactive does not mean connected.
An artifact can respond to clicks, filter embedded data, draw to canvas, and run a local simulation. It cannot phone home.
ALLOWED
- Inline HTML and CSS
- Inline JavaScript
- Data and blob images
- Data fonts and media
- Local browser interaction
BLOCKED
- Network requests
- Forms & password inputs
- Popups & downloads
- Parent navigation
- Frames & objects
- Service workers
Retention boundaryGone from the web first.
Gone from the web first.
Cleaned from storage next.
Guest URL expires
The artifact immediately returns 410 Gone. Its content is no longer publicly available.
Object cleanup
A deletion queue and R2 lifecycle policy remove payload objects. Reconciliation catches partial failures.
Metadata tombstone
Minimal non-content metadata can remain for abuse controls, audit, and deletion reconciliation.
Database history
Cloudflare D1 Time Travel may retain recoverable database history according to the platform's service window.
Important boundaries
What “unlisted” means.
Artifact URLs are bearer links, not access-controlled private documents. Anyone who receives a share URL can view it.
Artifact, collection, error, and expiry responses carry X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, noimageindex. They are not included in Linkifact sitemaps or crawlable marketing links. A robots directive is a request to compliant crawlers, not a confidentiality mechanism.
Do not publish credentials, personal data, confidential source code, or anything whose disclosure would cause harm. Linkifact scans for common secrets, but no scanner is perfect.
Responsible disclosure
Found a way through the box?
Send a concise reproduction to security@linkifact.com. Include the affected URL or request ID, impact, and only the minimum proof needed. Please do not access other people’s data or disrupt the service.
SECURITY CONTACTsecurity@linkifact.comRequest the current PGP key by email.
Publish with clear boundaries
Make the artifact. Keep the permissions small.
Publish anonymously in seconds. Guest links are unlisted and expire after 30 days.