Security & Acceptable Use

Security

HTTPS

All Dropley URLs, including artifact pages, are served over HTTPS. TLS is enforced at the edge.

Content Security Policy

Dropley applies strict Content Security Policy (CSP) headers to published artifacts. These restrict which resources (scripts, styles, images) the page can load.

No User Accounts

Dropley has no accounts or passwords. Your artifact token is the only credential for managing your artifact, and Dropley does not use cookies for authentication.

On the main Dropley website, we use a first-party anonymous dropley_session cookie to understand whether a visitor who lands on a marketing page starts an upload or successfully publishes an artifact. It contains a random identifier only; it is not an account, a login credential, or an artifact token.

The cookie is host-only, HttpOnly, Secure, and SameSite=Lax, with a 90-day lifetime. It is not shared with the separate published-artifact origin. The related measurement records retain only normalized discovery source, medium, optional campaign, and landing path—not full referrer URLs, arbitrary query strings, IP addresses, uploaded files, artifact tokens, or email addresses. See the Privacy Policy for details.

Abuse Protection

Dropley uses:

Rate limiting to prevent API abuse (per-endpoint, IP-based with HMAC-hashed identifiers)
WAF rules at the edge for common attack patterns
IP-based throttling with daily rotating HMAC-SHA256 hashing — no raw IPs stored
Abuse detection: Failed authentication attempts are tracked per identifier; after a configurable threshold, the identifier is temporarily blocked
Path traversal protection: Absolute paths, .. traversal, hidden files, and deep nesting are rejected
File type whitelist: Only allowed extensions (HTML, CSS, JS, images, fonts) are accepted
Origin isolation: Published artifacts are served with Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin
No iframing: frame-ancestors: 'none' prevents embedding in third-party sites

Data Deletion

When an artifact expires, all associated files and metadata are permanently deleted. No backups are retained.

Acceptable Use

What You Can Publish

Any static content that complies with applicable laws. Examples include:

Personal projects and portfolios
Design previews and prototypes
Documentation pages
Educational content
Open-source project demos

What You Cannot Publish

Illegal content: Anything that violates applicable laws
Malware or exploits: Files designed to harm systems or users
Phishing content: Pages impersonating legitimate services
Hate speech: Content that promotes violence or discrimination
Adult content: Pornography or sexually explicit material
Copyright-infringing content: Material you don't have rights to distribute

Enforcement

Abusive content may be removed without notice. Repeat violations may result in:

IP-level blocking
Upload rate limit reduction
Content removal

Reporting Abuse

To report an artifact that violates these policies, use the report link on the artifact page, or email hello@dropley.app.