Security
Published files never run on the app domain. Viewers sign in with the identity they already have. This page states the controls that exist today, and the ones that do not.
Can uploaded HTML reach the dashboard?
No. Every site is served from its own subdomain on a separate domain from the dashboard, so uploaded HTML lands in its own browser origin and cannot reach your session.
Do you store passwords for our people?
Sign-in goes through your identity provider over OIDC — Google, Microsoft, or any issuer with a discovery document. Publidock stores no user passwords to leak. Hosted email-and-password is optional, and those secrets are hashed.
Are customer sites indexed?
No. Served sites and every access screen send X-Robots-Tag: noindex, nofollow.