---
title: Security
description: Domain isolation, content safety, and security architecture.
section: Platform
order: 1
---

# Security

PageWeave's security architecture ensures isolation between platform code and user-generated content.

## Domain Isolation

| Domain | Purpose | Trust Level |
|--------|---------|-------------|
| `pageweave.dev` | Dashboard, API, MCP endpoint | Trusted platform code. Strict CSP. |
| `*.pageweave.site` | Hosted websites | Untrusted user HTML/JS. No platform cookies. |
| `assets.pageweave.dev` | Platform CSS/JS/fonts | Trusted static assets via CDN. |

Same-origin policy prevents `*.pageweave.site` JS from accessing `pageweave.dev` cookies or DOM.

## Cookie Policy

- Platform cookies set on `pageweave.dev` only
- `__Host-` prefix + `Secure` + `SameSite=Strict` + `Path=/`
- No platform cookies on `.pageweave.site` parent domain

## Content Safety

### Abuse Scoring

Every published page is scored for abuse risk:

- Obfuscation techniques (eval, base64, hidden iframes)
- Content length anomalies
- Excessive external links
- Hidden content (display:none, zero-size elements)
- Spam keywords
- Suspicious links (phishing patterns)

### Draft Pages

Unpublished pages include `<meta name="robots" content="noindex,nofollow">` to prevent premature indexing.

## Dashboard Protection

- `X-Frame-Options: DENY` on all `pageweave.dev` routes
- `Content-Security-Policy: frame-ancestors 'none'`
- Dashboard previews render user HTML in sandboxed iframes
- CORS: API never allows `*.pageweave.site` origins

## Request Handling

- Unknown Host headers → 404
- Page path sanitization: whitelist `[a-z0-9\-_/]` only
- Metadata escaping in layout templates
- Rate limiting on MCP tools per account

## API Key Security

- Keys bypass OAuth scope checks (full access)
- Key rotation from dashboard
- Audit log: all MCP tool calls recorded