Pages made with Bellows run inside the browser's sandbox

What a page may not do stops at the edge

A page made with Bellows runs inside the browser's sandbox, drawn here as the ring. A script from another site, a request to another server, a cookie: each one arrives at the edge and stops. The framed embed inside the page has a smaller sandbox of its own.

A strict content security policy

Every page carries a policy that allows scripts only from its own origin. There is no inline script and no eval. The page makes no request to another site and sets no cookies, so there is nothing to track you with and no banner to dismiss.

Four more rules the tool keeps

There is no plugin

The output is HTML, SVG, CSS and a small script. The browser is the runtime.

Importers never run what they import

Flash, SVG and Animate files are read as data and converted into the document format. Imported scripts stay off until you trust them.

Embeds are sandboxed

An embedded page runs in a frame with only the permissions the document names, and messages are accepted only from that frame.

Documents are untrusted input

Text goes into the page as text, addresses are checked before they are used, and style values come only from numbers and colors.