Private by default, shared on purpose

A fresh deploy is readable by you and nobody else. Every step past that is one you took on purpose, and the product says what it means before it happens.

Get startedHow the gate works

Three states, and you pick

  • Private, nobody named. You, and no one else. This is where every artifact starts.
  • Private, shared with addresses. You and the people you name. They are emailed to say an artifact was shared and where it is — before that existed, being granted access was completely silent.
  • Public. Anyone holding the URL, without signing in.

Why the enforcement is split

Neither half of the system can do this alone. The platform is the only thing that can decide — the session cookie is on its origin and it can evaluate a share list against a person — and it holds none of the artifact bytes. The worker is the only thing that can serve, and it has no database credential at all.

So the platform decides once and signs the decision, and the worker verifies that signature on every subsequent request. This is also why artifacts are addressed by id on one shared host rather than by a subdomain each: a hostname per artifact is its own origin, and an origin the platform cannot set a cookie on can only ever be protected by “know the URL”.

The hour, stated plainly

A signed decision lasts one hour and is bound to one artifact. Un-sharing therefore takes up to an hour to take effect for somebody already holding one.

That is a deliberate price rather than an oversight: the alternative is a database round trip on every image, script and stylesheet an artifact requests. It is written here, on the marketing page, because it is exactly the kind of thing that should be known before somebody relies on revocation being instant.

The rest of it