Privacy · Terms · Security and data

Security and data

How artifacts.boo keeps workspaces and readers safe, for anyone deciding whether to use it at work. The design is public in the source on GitHub. Report a vulnerability to michael@thiesen.dev; please give us a chance to fix it before publishing.

Isolation

• Each workspace is its own Cloudflare Durable Object with its own SQLite database, served from its own subdomain, so browser cookies and storage are separated by origin too.
• Artifact code is treated as untrusted. It runs in a sandboxed, opaque-origin frame that can't make network requests or open popups; links that leave the workspace ask first. Storage, shared state and comments reach it only through the page around it, scoped to that one artifact. A frame that tries to navigate itself elsewhere is replaced.
• Comments are drawn outside the frame, and votes, comments and checklist ticks are stamped with the verified signed-in email on the server, so artifact code can't forge them.

Sign-in and access

• People sign in with eight-digit one-time codes emailed to them; codes are stored hashed, expire in 10 minutes, and sending and guessing are limited per address and network.
• Or with a passkey they saved: only its public key is stored, every sign-in requires the device's own check (Face ID, fingerprint or screen lock), and each sign-in challenge works once.
• Sessions are signed, HTTP-only, secure cookies bound to one host. Every request checks the artifact's sharing, so removing someone takes effect immediately.
• Agents connect with OAuth 2.1 (PKCE, per-workspace audience) or a personal token stored as a hash. An agent acts as one member, with that member's access, and loses it when they leave the workspace.
• Links that sign straight into an artifact are only ever emailed to their own person (or given to an agent for its own person), open that one artifact, and expire.

Data

• Everything is served over HTTPS with HSTS. Data is stored on Cloudflare (Durable Objects, R2, KV), encrypted at rest by Cloudflare.
• Nightly backups to R2, up to 30 kept (7 on Free). A restore loads everything first and swaps it in at once, so it never leaves data half-replaced.
• Live data is only fetched from hosts a workspace admin approved, over HTTPS, without credentials.
• See Privacy for what's stored, who handles it and for how long.

Subprocessors

Cloudflare, Inc. (hosting, storage, email, headless browser, analytics, logs). Notification services you add yourself (Pushover, ntfy, webhook targets, browser push services) receive the notifications you route to them.

Last updated 2026-10-18.