Security and limits
Why Site Kit is keyless, how imports are authorized, and which safety caps apply.
Site Kit runs locally. It needs no SnabbSajt API key, network token, or write access to a customer workspace.
Trust boundaries
- Local validation is feedback, not authorization.
- SnabbSajt validates the package again on import.
- Import requires a signed-in user allowed to create a website.
- Import creates a draft and never publishes automatically.
- Asset bytes are checksummed, decoded, and screened server-side.
- Raw HTML, JavaScript, iframes, and custom CSS are outside the model.
- Public URL fetches block private/reserved IP space, redirect escapes, unsafe protocols, oversized bodies, and slow responses.
- WXR rejects DTD/entity declarations and enforces byte, depth, element, item, metadata, author, term, attachment, and text-node limits.
Current limits
The SDK exports PORTABLE_CAPS. Portable format v1 currently allows up to 50 pages,
500 sections, 200 assets, 12 fonts, 5 MB of JSON, 15 MB per image, and 150 MB
for the complete bundle.
Secrets
Do not put API keys, private application files, customer credentials, or hidden
data in site.json. The package becomes website content that workspace editors
can inspect.
Why there is no API key
The current workflow does not call a hosted API. Adding keys now would create a new credential, rotation, scope, and abuse surface without improving local conversion. A future CI/upload API should use separate, scoped, revocable tokens. Local validation and packing should remain keyless.