What an upload may contain
File types, sizes and the HTML rules every deck is checked against.
Every upload is checked before anyone can open it. The checks enforce supported formats and resource limits; the hosted sandbox provides isolation. If a deck is refused, the report lists each file and the rule it broke, so you can fix it and upload again.
What you can upload
- A single
.htmlor.htmfile. - A
.zipwith anindex.htmlat the top, or inside one top-level folder (that folder is removed). - Each file, including a single HTML upload, must be at most 16 MiB. Static SVG images have a 512 KiB limit.
- The maximum size of a deck and of your whole workspace depends on your plan; see Pricing.
What is refused
| Rule | Why |
|---|---|
No index.html | Lumdeck needs to know which page opens first. |
Absolute paths, .., backslashes, drive letters | They could point outside the deck. |
Executables and server scripts (.exe, .sh, .php, .py, …) | Decks are static; these never run in a browser. |
Archives inside the zip (.zip, .7z, .rar, .tar, …) | Unpack them first. |
| Encrypted or password-protected zips | They cannot be checked. |
| More than 5,000 files, or extreme compression ratios | Zip bombs and accidental uploads of whole drives. |
| Files whose content does not match the extension | A ".png" that is really a program is refused. |
<base> tags, refresh to another site, forms posting to another site | They would send viewers elsewhere. |
| PDF attachments | Export PDF pages as PNG or WebP images. |
| HTML or SVG that is not valid UTF-8 | Save the file as UTF-8 and upload it again. |
What is cleaned quietly
.DS_Store,Thumbs.dband__MACOSX/are dropped.- Unknown file types are dropped and listed in the report.
- SVG images are parsed and rebuilt as static drawings. Scripts, animation, links, embedded HTML, CSS and external resources are removed. Malformed XML and DTDs are refused.
External resources
Deck networking is restricted by default. Workspace admins can explicitly allow scripts, styles, fonts and images from these CDNs: cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, fonts.googleapis.com, fonts.gstatic.com, cdn.tailwindcss.com and esm.sh. Those providers can receive requests and data from the deck. Bundle resources locally for confidential content. Other external resources remain blocked.
How decks run
Decks open in a sandbox on a separate web address. A deck cannot read your Lumdeck account, set cookies, see who is watching or navigate the viewer's page. This is also why a deck cannot call your own servers from inside Lumdeck.
Lumdeck does not scan uploads for malware yet. It applies format checks and refuses native executables, server scripts and nested archives, and runs every deck in the sandbox above. See what Lumdeck does and does not do.
Downloaded originals contain unmodified code and run outside the hosted sandbox. Only open files you trust.