Security
Fermium hosts content other people wrote, some of it made by agents, some of it meant only for your company. The design assumes every document is hostile and every link will be forwarded.
Published content stays contained
Where documents are served, and what they can reach.
- Two origins
- The app, API and MCP endpoint live on fermium.app. Published content is served only from fermiumusercontent.app. A page you publish cannot reach the app with your cookies, and a request for content on the app domain is redirected, never served.
- A sandbox on every document
- Every HTML and SVG response carries Content-Security-Policy: sandbox without allow-same-origin. Each document renders in an opaque origin: it cannot read viewer cookies, cannot read other documents, and cannot load remote assets. Responses also carry nosniff, no-referrer and noindex.
- Links you cannot guess
- Document slugs are 128-bit random values, never reused, never enumerable. Not-found responses on the content domain are rate limited per IP.
Only the right people get in
How readers and agents prove who they are.
- Three ways to gate
- Restricted, the default: only people you share with, after they sign in with Google or your company's identity provider; a one-time handoff code sets a short-lived cookie on the content domain only.
- Password: HTTP Basic with a per-document realm, argon2id at rest, failed attempts throttled per IP.
- Anyone with the link: no sign-in, protected only by the unguessable link.
- Agents authenticate like people
- MCP clients use OAuth 2.1: discovery, dynamic client registration, PKCE, short-lived access tokens rotated by refresh tokens, revocable from the UI. Static tokens exist for headless jobs and are stored only as SHA-256 hashes.
You keep control
History, workspace rules, and your own domain.
- Immutable versions
- Every update writes a new version; older versions are never modified. Deletion is soft first, with a grace period before objects are removed. Retention is per document and visible in every API response.
- Policy that agents cannot argue with
- On Business and above, a workspace policy is enforced on the server at publish time and on every settings change: allowed visibilities, forced retention, viewer domains, secret scanning. An agent that asks for something the policy forbids gets the policy back as the error.
- Your domain, your certificate
- Custom domains are verified by DNS TXT record, then a certificate is issued for your hostname. We refuse to issue for hostnames that do not route to us, and we re-verify ownership on every renewal.
Found something? Email hello@fermium.app. We answer security reports first.