Hosted public capture rejects private/link-local targets by default. Local/private capture is explicit opt-in. Redaction selectors can hide sensitive UI before screenshots or video are persisted.
Preview compilation uses an allowlisted runtime. Arbitrary model-written final-render code belongs in an isolated worker with CPU, memory, time, disk and network limits—not in the control plane holding credentials.
The production data model uses workspace membership and row-level security. Provider secrets are referenced from a secret store and should not be stored directly in ordinary application rows.