renza

Security

Renza is designed to host HTML and JavaScript that we do not trust. Uploaded content is kept separate from the application, while Renza's navigation, sharing controls, comments, and account sessions remain on the trusted app origin.

Content isolation

Uploaded artifacts are served from renzausercontent.com, a different registrable domain from renza.io. They render inside an iframe with sandbox="allow-scripts"; Renza does not grant the frame same-origin access. In practice, this means:

  • Renza session cookies are not available to the artifact.
  • The artifact cannot read or modify the parent application's DOM.
  • The iframe receives an opaque origin, which also isolates artifacts served from the shared content domain from one another.

Renza adds a small postMessage bridge to support slide navigation and anchored comments. The parent accepts messages only from the iframe window it created. Identity, permission checks, and API calls stay in the parent application; credentials are not sent through the bridge.

Artifact and asset access

Artifact HTML and uploaded assets are stored in a private object store. After Renza authorizes a viewer, the app creates a signed capability for one artifact. That capability:

  • is carried in the renzausercontent.com URL path;
  • is verified by the content service before HTML or an asset is returned;
  • expires after one hour by default; and
  • covers relative bundle assets, so images, fonts, audio, and video pass through the same gate as the entry HTML.

Capabilities are signed and self-contained. Revoking a share prevents Renza from minting another capability, while an already issued capability can remain usable until its short expiry. Responses from the content service use no-store, and invalid or expired capabilities return the same 404 response.

Trusted controls

An uploaded artifact can draw anything inside its own frame, including something that resembles a button or sign-in prompt. Renza therefore keeps its real controls outside the artifact: the viewer toolbar, sharing controls, comment UI, report action, and Renza badge all render in trusted parent chrome. Renza never asks for account credentials inside an uploaded document.

Data handling

Traffic between browsers and Renza services is encrypted in transit with TLS. Metadata is stored in Postgres on Neon. Artifact files are stored in a private object store and are not exposed through public bucket URLs. Our current subprocessors are listed in the Privacy Policy.

Workspace access can be managed with member roles, per-person grants, link revocation, protected links, and version history. See Sharing and permissions for the controls currently available.

Reporting a vulnerability

If you find a security issue, email security@renza.io with enough detail for us to reproduce it. Please avoid accessing other users' data and allow reasonable time for a fix before public disclosure. Good-faith research is welcome. Our machine-readable contact record is available at /.well-known/security.txt.