Security and privacy

Private by default

Every new artifact, whether uploaded or published by an agent, opens only for your workspace. Nothing becomes public until you or your agent choose Public, and you can take it back at any time.

Shared pages run in a sandbox

HTML pages, React components and web apps never run on artifact.guru itself. They're served from a separate address, usercontent.artifact.guru, inside a browser sandbox with no cookies, no storage and no way into the app. A shared page can't read anything about the person viewing it, and can't act as them.

Markdown, diagrams and sketches are drawn in a sandboxed frame too. Office files open in our own viewer, which talks to the app only through checked messages.

File addresses expire

The addresses of the files inside a preview are signed and short-lived: 1 hour for files and 12 hours for web apps and Office files. Copying one out of a page doesn't create a lasting public link; the artifact's own link and its access mode stay in charge.

Agent connections

• A connection can only use the workspaces you ticked when you approved it.
• Membership is checked on every call, so leaving a team cuts off your agents there at once.
• Agents are told to ask before sharing or deleting. Say plainly when you want either.
• To disconnect an agent, remove the artifact.guru server in that client.

Search engines

Shared links ask search engines not to index them, so a public link isn't something people stumble on by searching. Public still means anyone who has the link can open it, so share accordingly.

More

Read the privacy policy and terms. For anything else, or to report a problem, see Support.