A few of the projects in this directory are a single HTML file — an editor, a prompt library, a preview tool. There is no install and no sign-up: you press Launch app and it runs right here. That convenience is also the problem, because “right here” means on this domain.
Why serving your own HTML is risky
A page served from your domain shares your origin. Its scripts can read what the browser has stored for you, make requests that carry your login cookies, and reach into other pages of the site open in the same tab. That is fine for code you wrote this morning and can see, and much less fine as a standing arrangement — especially once a file has been sitting in an uploads folder for a year and a plugin update lets someone else write to that folder.
So these apps never run with this site’s origin, even though they load from this site’s address.
An origin that isn’t mine
Each app is served by its own endpoint, and that response carries a Content-Security-Policy: sandbox header. The sandbox directive gives the document an opaque origin — a unique one that matches nothing else — even when it is opened as a top-level page rather than inside a frame. Scripts and forms are allowed because the apps need them; allow-same-origin never is, because that hands back exactly what the sandbox took away.
The upshot: the app can do whatever it likes inside its own page, and nothing at all outside it. No cookies, no stored data, no credentialed requests back to the site.
Storage that quietly disappears
An opaque origin has no storage, so localStorage doesn’t return empty — it throws, and an app that saves your work on every keystroke dies on the first one. A small shim goes in ahead of the app, notices the exception and swaps in an in-memory version with the same shape. Apps work normally for the session, and anything they save is gone when you close the page. The note under the launch button says so, because someone who has typed for ten minutes deserves the warning.
Files that are never pages
The uploaded files are stored with a .html.txt extension, so the web server itself will never serve one as a page. Only the endpoint reads them, and only after checking the project is published and the visitor is allowed to see it. This matters more on nginx, where the usual trick of dropping an .htaccess into the folder does nothing at all.
Taking a copy
Free apps can be downloaded and kept — they are one file, so they work from your own desktop with no server at all. That download is sent as an attachment with a binary content type and X-Content-Type-Options: nosniff, which keeps the browser from deciding to render the file instead of saving it. A download that renders would undo the whole arrangement.
Try one and see: Prompt Library runs in the page, saves nothing, and comes with a download link.