scopedraft.dev

This domain hosts draft site previews for Scopeweb. Each preview lives at {draft-id}.scopedraft.dev and contains user-submitted content.

Why a separate domain

User content never shares scopeweb.io's cookie scope or its blocklist reputation. If someone abuses a preview, this domain absorbs it and the API, the MCP endpoint and the main site stay up. Same reason Vercel ships to vercel.app.

Previews are sandboxed

Every preview is served noindex with a Content-Security-Policy pinning form-action and connect-src to 'self' — the browser refuses credential exfiltration regardless of what the markup tries.

Content is screened

Drafts are scanned on every version for external form actions and brand-impersonating credential pages. Flagged drafts serve 451 and stop being reachable.

Report abuse

Seen a preview here doing something it should not? Tell us and it gets reviewed. A takedown removes the content from storage, not just from view.

No account needed. Reports are rate-limited per IP and logged.