Privacy boundary

Podda hides reusable platform credentials from generated code and gates every app by named membership. Arbitrary browser JavaScript is not physically incapable of exfiltration: an owner-approved browser origin can receive data readable by the app. An owner-approved script origin goes further — it executes third-party code with the app's full privileges, and that code can change at any time without redeploying. Use synthetic, non-sensitive data during the POC and never embed secret or service-role credentials.

A server-only capability cannot be called directly by a member's browser. The Worker receives trusted member identity and decides how to namespace or authorize records. This protects direct KV/file access, but Worker code can deliberately return values through its own API routes or write them into raw logs. KV is private platform storage, not a vault against the app's own Worker code.

Last updated 22 August 2026 · Documentation version 7