Draft. Summer Apps is in a closed test. This page goes live after the end-to-end test on production.
| Risk | What Summer does |
|---|---|
| An app tries to act as you on summerengine.com | App code is served only from apps.summerengine.app, a different site, inside a sandbox (allow-scripts allow-forms allow-popups allow-modals allow-downloads, never allow-same-origin) with no cookies, no storage and no access to Summer’s pages. It can only ask the Studio page that hosts it, over one private channel. |
| An app sends your data somewhere | Apps have no network access. A team admin can allow specific domains for their team’s apps. |
| An app does more than it says | Every call is checked against the permissions in its manifest, twice: in Studio and on Summer’s servers. |
| An app reads another team’s data | Every call runs as the person using the app, with their team membership. People outside the team get “not found”. |
| An app damages your project (engine access comes with the next Summer Engine update) | Only an allowlist of editor operations, only declared files, no scripts or shell, no deletes. Enforced by Summer and inside Summer Engine. |
| An app spends your credits | Paid calls are charged to the person using the app and shown in the app’s cost meter. Members have a daily spending limit per app that owners and admins can change. |
| A bad app is shared in a team | Apps are shared only inside a team. Owners and admins can turn off one app or all apps for the team. |
| Someone frames an app elsewhere | App pages can only be shown inside Summer Studio. |
| An agent’s look at an app changes something | summer_app_screenshot renders the app read-only: writes and paid calls are refused, events and notices are not delivered. |
| An app’s files are changed | Every published version is immutable, and every file is checked against its recorded hash when it is served. |
summer_app_page.