# Slidesfly Security Architecture

Last reviewed: 2026-07-28
Canonical page: https://slidesfly.com/security

Slidesfly publishes untrusted HTML. It separates the account and reader origins, renders deck code
inside an opaque-origin sandbox, keeps object storage private, and checks the current deck policy
before content is served.

## Security boundaries

- **Account vs reader:** slidesfly.com and slidesfly.xyz. Keep account and write surfaces off the content origin.
- **Reader vs deck:** Sandboxed iframe without allow-same-origin. Give uploaded HTML an opaque origin.
- **Storage:** Private R2 with a policy gateway or short-lived signed URL. Prevent a direct public-bucket bypass.
- **Lifecycle:** Current version, expiry, visibility, and moderation checks. Make a stable path follow current policy state.

## Deck iframe sandbox

```html
sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox allow-forms"
```

`allow-same-origin` and `allow-top-navigation` are intentionally absent. Browser storage such
as localStorage, sessionStorage, and IndexedDB is not a reliable persistence layer in the
opaque-origin deck.

## Private object access

- R2 buckets remain private.
- Public and unlisted content uses a gateway that checks current database policy.
- Private, password, and allowlist flows receive short-lived signed object URLs only after viewer
  authorization.
- Expired, deleted, quarantined, and non-current historical content is not exposed by the stable
  content path.

## Upload and abuse controls

- Single-file decks cannot load remote scripts.
- Multi-file deck scripts must use local relative paths inside the archive.
- Known blocklisted domains and unsafe archive paths are rejected.
- Zip traversal, duplicate normalized paths, file count, and expansion limits are checked.
- Published decks can be reported and quarantined under moderation policy.
- Rate limits and plan quotas protect publish and view-event paths.

## Important limits

Sandboxing reduces risk; it does not mean zero risk. Do not publish secrets, credentials, regulated
data, or content you are not authorized to host. Embed mode changes whether the reader shell may be
framed; it does not loosen the inner deck sandbox.

Use the report control on the reader for abusive content. Use the project owner's private security
contact for a suspected vulnerability.