Captured pages never run code
Before any step is shown, our processing pipeline removes scripts, inline event handlers, javascript: links, embedded objects, form actions and refresh tags from the captured page tree. The player then rebuilds the page inside an iframe without script permission, so even content that slipped through cannot execute.
A separate domain for demos
Published demos are served from a dedicated player domain, never from the app where you sign in. A strict content-security policy limits what the player may load. The editor canvas uses the same sandboxed rendering.
Masking and private storage
Password fields are always masked in the browser; “Mask all form inputs” masks the rest. Raw recordings stay in private storage behind short-lived signed links. Only processed snapshots of published versions are public. Preview links use long random tokens stored as hashes and are not indexed.
Access control
Every request checks that you belong to the workspace that owns the demo. Roles are owner and editor. The extension uses its own token, limited to recording, which you can revoke from the app.
Reporting a problem
Found a vulnerability or a demo that abuses LiveDemo? Email siddhu@lasyaaitech.com with details. Please give us reasonable time to fix issues before disclosure.
