Security & trust

Canvas produces a document that renders inside your browser, so its isolation and data-handling rules matter. Here's how it keeps your account and your machine safe.

The document is sandboxed

A Canvas document renders in a sandboxed iframe (sandbox="allow-scripts allow-popups", with no allow-same-origin). That means the document's own scripts run, but they get an opaque origin — no access to your Nexrall session, cookies, localStorage, or the surrounding app's DOM. A document can't reach out and read your account, and it can't be tricked into running in a privileged context.

Navigation stays inside the document

Any link or button a reader clicks behaves as if the document were the whole page:

• Links that would escape the iframe (target="_top" / target="_parent") or JavaScript that sets top.location / parent.location are forbidden — the agent is told never to write them, so clicking "Next section" can't yank the reader out of the document into the host app.
• In-document navigation (tables of contents, "back to top", slide decks) uses in-page anchors, never real browser navigation.
• Genuine external links are fine, and open safely.

Sources are untrusted data

Everything read from a source — an uploaded PDF, a spreadsheet, a web page, a fetched image — is treated as untrusted reference data, never as instructions. Text embedded in a document won't be followed as if you had typed it, which is the same prompt-injection defense used across Nexrall.

Network access is scoped

• fetch_url / fetch_image refuse to reach Nexrall's own internal hosts (api. / app. / admin.nexrall.com) and block SSRF against internal/private addresses — they can only fetch public content, same as any site.
• web_search is a client-side tool run by Nexrall itself, so it behaves identically on every model provider.

Image generation guardrails

The agent is told never to generate a lookalike of a picture you already provided — if you attach an image and want it in the document, it embeds that image's own URL rather than charging you for an AI-recreated approximation. Image-to-image editing (edit_image) is a separate, deliberately gated tool used only when you actually want a new image derived from an existing one.

Sharing is permission-scoped

• A public link is always read-only — the document only, no chat, no editing, no access to your account.
• An edit invite lets the other person send messages to the agent on your artifact — billed to your balance — and can be revoked any time.

Next steps

• How it works — the verification and model layers.
• Sources & grounding — how your files are handled.