Uploaded code cannot share the app domain
Customer projects run on *.every.link. Authentication, billing, and administration run on the separate dashboard domain. The marketing apex is static and must never set cookies. This prevents customer-authored JavaScript from sharing the dashboard's cookie boundary.
Tenant resolution is account-scoped
A content request resolves the account from its host and the project from an account-unique slug. Internal workspaces remain part of authorization and ownership, but are not trusted as public routing input. Dashboard queries retain both account and workspace scope.
Publishing keeps history
Deploys are immutable. Project assets live in private object storage and are delivered only after the current deploy and viewer authorization have been resolved. Rollback selects an older deploy rather than modifying or replacing files.
Access is evaluated on every request
Projects can be public, password-protected, limited to signed-in viewers, restricted by verified email domain, or governed by SAML rules. Optional isolated project origins provide a browser-enforced boundary between projects that handle more sensitive data.
Report a vulnerability
Send a concise reproduction, affected URL, and potential impact tosupport@every.link. Please do not include live credentials or personal data in the first message.