Skip to content
Product // Security

How Lumdeck keeps decks separate

What a visitor of a shared deck can and cannot do, in plain language.

How a deck is isolated

Every deck runs in a sandboxed viewer on its own web address, separate from the app where you sign in. The sandbox does not share cookies, storage or the page around it with the deck. A deck cannot navigate your browser away from the viewer, and it cannot open popups. Links that leave a deck go through a short leaving page on the app so you can see the address before you follow it.

What an upload is checked for

Supported files are checked before a deck becomes viewable: executables, server scripts, nested archives, encrypted zips, files whose content does not match their extension, and HTML that would redirect the viewer or post a form to another site. What is allowed is listed in What an upload may contain.

PDF attachments are refused. SVG files are limited to static drawings, and WebAssembly files require the expected format header. HTML and JavaScript checks do not establish that code is safe.

Uploads are not passed through an antivirus engine. That limit, and the others, is on what Lumdeck does and does not do.

Share links

A link can be public, password-protected, limited to people who confirm an e-mail, or limited to named people. You can set an expiry and a view limit, and you can revoke a link. A revoked link, a deck in the trash and a deck taken down after a report stop loading in the viewer within 30 seconds. Details are in Share links.

On Pro and Team you can name the websites allowed to embed a link. Every other site is refused. Free links cannot be embedded.

Reporting

Every share page has a report button. Reports are reviewed in the admin console, and a taken-down deck stops being served.

Original downloads and administrator access

Downloaded source contains its original code and loses the hosted sandbox and network restrictions when opened elsewhere. Only open source you trust. Library previews use stored images or static placeholders.

Platform administrators must verify a passkey or security key to enter the admin console, and verify again before sensitive changes when their last verification is more than five minutes old. This requirement applies to platform administration.