Security

PageWeave’s security architecture ensures isolation between platform code and user-generated content.

Domain Isolation

Domain	Purpose	Trust Level
`pageweave.dev`	Dashboard, API, MCP endpoint	Trusted platform code. Strict CSP.
`*.pageweave.site`	Hosted websites	Untrusted user HTML/JS. No platform cookies.
`assets.pageweave.dev`	Platform CSS/JS/fonts	Trusted static assets via CDN.

Same-origin policy prevents *.pageweave.site JS from accessing pageweave.dev cookies or DOM.

Cookie Policy

Platform cookies set on pageweave.dev only
__Host- prefix + Secure + SameSite=Strict + Path=/
No platform cookies on .pageweave.site parent domain

Content Safety

Abuse Scoring

Every published page is scored for abuse risk:

Obfuscation techniques (eval, base64, hidden iframes)
Content length anomalies
Excessive external links
Hidden content (display:none, zero-size elements)
Spam keywords
Suspicious links (phishing patterns)

Draft Pages

Unpublished pages include <meta name="robots" content="noindex,nofollow"> to prevent premature indexing.

Dashboard Protection

X-Frame-Options: DENY on all pageweave.dev routes
Content-Security-Policy: frame-ancestors 'none'
Dashboard previews render user HTML in sandboxed iframes
CORS: API never allows *.pageweave.site origins

Request Handling

Unknown Host headers → 404
Page path sanitization: whitelist [a-z0-9\-_/] only
Metadata escaping in layout templates
Rate limiting on MCP tools per account

API Key Security

Keys bypass OAuth scope checks (full access)
Key rotation from dashboard
Audit log: all MCP tool calls recorded