Limits and security boundaries
Design within the current limits and understand what the platform does—and what your handler must do.
On this page
Current limits
These are ceilings, not guaranteed capacity. Per-site and platform rate limits also apply. Keep content small and work bounded. Byte limits and character limits differ for non-ASCII content.
| Resource | Limit |
|---|---|
| Page | 128 KiB; 512 components; nesting depth 12 |
| Title / component text | 120 / 4,096 characters |
| List | 128 items |
| Image | 128 columns × 64 rows |
| Select | 1–32 options; 120 characters per option |
| Form request | 32 fields; strings up to 2,048 characters or booleans |
| Hub package | 1–32 files; 256 KiB serialized |
| app.lua | 64 KiB |
| Cloud site storage | 128 KiB |
| Cloud execution | 1 million instructions; 3-second process timeout |
| Runtime memory / VM lifetime | 64 MiB JavaScript heap; 15-second VM timeout |
Execution and identity
Browser pages are data, never downloaded executable Lua. Hub Lua runs in a fresh isolated VM with a restricted environment and no arbitrary network access. Local owner-installed Lua is not sandboxed.
Hub connections use HTTPS. Modem sites use encrypted transport with persistent identities. Friendly discovery names do not prove identity; verify fingerprints separately. Neither transport encryption nor a password input creates application-level visitor accounts.
Keep private data private
The browser’s masking only hides field display. Operators receive submitted fields. History stores addresses, and GET pages may be cached. There is no built-in site-user identity or private-session API.
- Never put upload keys, seeds or identity files in a page or package.
- Treat every field as untrusted: check its type, length and permitted values.
- Do not return secrets in GET pages; browsers can save them for offline use.
- Do not store real passwords in plaintext or use the demo code pattern as authentication.
- Keep mutations on POST routes and bound stored lists.
Status and testing scope
The status page reports current API/database observations and the latest manual cloud Lua canary. Cloud observations expire to unknown after 15 minutes. A complete Hub outage may also affect the status page.
Application security probes and runtime tests are automated, but this development preview is not a certified or independently audited secure platform. Real Minecraft compatibility, broader fault/load tests and release acceptance remain ongoing.
Found a mismatch? Include the exact error, runtime version and a small example with secrets removed.