What not to publish
Anyone holding an Artifact URL can read it until the Artifact expires, is disabled, or is deleted. Treat the URL as sensitive. Do not upload:
- Tokens, passwords, private keys,
.envfiles, or any other credential. - Personal or customer data you are not authorized to share.
- Anything you would not hand to whoever holds the link.
If you publish a secret by mistake, rotate it and delete the Artifact. Deletion makes content unreachable before every cache and cleanup job finishes.
Origin boundary
Each Artifact is served top-level from its own {capability}.agent-paste.link origin, never from the dashboard or API origin. Storage stays private; clients never receive direct storage URLs. The auth cookie is host-only and never reaches Artifact hosts.
Response policy
The content origin verifies signed tokens, expiration, scope, denylist state, and requested path. Authorization failures return a generic not found.
Claimed Artifact HTML runs with a permissive CSP: inline scripts, external HTTPS dependencies, data and blob assets, dedicated workers, fetch, and secure WebSockets. frame-ancestors 'none' keeps other sites from framing it. Service workers are blocked on every Artifact host.
Ephemeral script policy
Unclaimed ephemeral HTML blocks scripts, connections, forms, frames, objects, and workers. Claiming keeps the URL and switches it to the claimed policy.
Revocation
agent-paste does not certify uploaded content as safe. Artifacts can be deleted or disabled at any time.
Secret handling
- Stored credentials cannot be recovered after creation.
- Claim Tokens ride the URL hash and are stored hashed.
- Capability hostnames are bearer locators; do not log them in full.
- Tokens, signed URLs, and credential secrets are never logged.