Skip to content
Open studio
StudioTemplatesDocsPlansSecurityTokenYour projectsVerify a ZIPX @kodzi
Buy $KODZIat launch

Live preview

Your project runs in a sandbox, next to your code.

The studio builds one HTML document from your entry page (index.html, or the first HTML file): local stylesheets and scripts are inlined, and a small console bridge is added first. That document runs in an iframe with sandbox="allow-scripts" and no same-origin permission.

What the sandbox blocks

  • Reading the studio’s storage, cookies or wallet connection (the frame has an opaque origin).
  • Network requests, external scripts and stylesheets, forms, popups and navigating the studio.
  • Storage inside the preview itself: use variables in memory, as the templates do.

The content security policy of every preview run:

default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob: https:; font-src data:; media-src data: blob:; connect-src 'none'; form-action 'none'; frame-src 'none'; base-uri 'none'

Console

console.log, info, warn and error, uncaught errors and unhandled promise rejections appear under the preview as plain text. Messages from anything other than the current run are ignored.