Trust is part of the template.

Views should do what they say, with as little access as possible.

What is available now

The public directory contains first-party HTML and CSS starter packages. They include their source and do not contain JavaScript or remote resources. Community drafts stay private and are never executed by this website.

JavaScript

The JavaScript field is required to be empty at the database boundary. Executable HTML is flagged for maintainers by the static source checks. Owner-authored JavaScript packages will need a separate release process; that publishing route is not enabled on this website yet.

Review design

Maintainers now see parser-based checks for active HTML, non-fragment and templated URLs, CSS imports, selected legacy CSS behavior, and source size. The report records its rule-set version and a hash of the exact source. It runs without executing code or fetching referenced resources.

These are advisory checks, not a safety certification or a complete publication gate. Rendered template values, runtime behavior, unexpected package files, and JavaScript require further review. Public community publication remains disabled.

An LLM can help trace suspicious behavior and explain findings. It can also miss vulnerabilities or follow malicious instructions hidden in a submission. It must review untrusted content without credentials, execution access, or authority to approve releases.

Reporting a problem

Use the project security page for reporting instructions. Do not include private vault contents or credentials in a public issue.

Future paid views

Paid publishing is not available. Encryption alone cannot guarantee secrecy for code that runs on a customer’s device. Licensing, distribution, and execution need to be designed together.