Security

We serve HTML that strangers wrote. Here is how that is contained, and where the limits are.

$ isolation

Every page is served with:

Content-Security-Policy: sandbox allow-scripts allow-forms
  allow-popups allow-modals allow-downloads
  allow-top-navigation-by-user-activation

The sandbox directive puts the document in an opaque origin. It cannot read cookies or storage for any real origin — including ours — and because each document gets its own opaque origin, one page cannot reach another’s DOM even though both are served from the same host.

allow-same-origin never appears in that list. Its absence is the entire mechanism, so it is asserted by a test rather than left to a code review.

$ why not sanitize

Stripping <script> does not stop JavaScript. HTML has around a hundred other vectors — every on* handler, javascript: URLs, <iframe srcdoc>, <svg onload>, <base>, MathML. Blocking all of it means a strict allowlist and a permanent commitment to chasing bypasses.

Restricting authors to libraries we host does not work either: several popular libraries are string evaluators, so allowing them back allows arbitrary execution delivered by our own trusted script. That is the script-gadget bypass which made CSP host-allowlists obsolete.

Isolation is a better boundary than inspection, and it costs the author nothing — scripts keep working.

$ limits

Shared domain. Pages are served from artifacts.to1page.com. Isolation is per-document, so one page can never reach another’s data. What a shared domain does mean is that our abuse handling has to be good.

Abuse handling. Free pages expire after 7 days, are capped in number, get random unguessable slugs rather than chosen ones, and are never indexed. Every publish is screened before it is served. Confirmed abuse is purged from every edge location, and the bytes behind it are blocked from being republished under a new slug or account.

Third parties. When a page is flagged for review, its URL and outbound hosts are checked against Google Safe Browsing, and its extracted text and form targets are classified. This applies to flagged pages only, including unlisted ones.

Availability. We do not offer an SLA on the free or entry tiers.

$ reporting

Vulnerabilities in to1page itself: [email protected]. We will not pursue action against good-faith research that respects user privacy and avoids degrading the service.

An abusive page hosted here: to1page.com/abuse or [email protected]. We review within 24 hours and purge confirmed takedowns from every edge location.

security.txt