Keep credentials server-side
- Permanent storage credentials never leave the server.
- CLI, browser, CI, and guests receive scoped, short-lived grants or signed URLs.
- Object bytes transfer directly between the client and private object storage.
- Tokens, cookies, OAuth codes, and signed URL queries are excluded from logs.
Handle public capabilities
Share, preview, inbox, and one-time secret URLs carry high-entropy capabilities. Blob Yard stores hashes and returns raw capability values only when the public URL is first created.
Respect origin and provider boundaries
Static preview HTML runs on a unique blobyard.dev origin. Web Yards run on isolated blobyard.app origins. Neither origin can receive application cookies. GitHub assertions, payment and email provider webhooks, and storage metadata are verified before protected state changes.