This domain hosts draft site previews for Scopeweb. Each preview lives at {draft-id}.scopedraft.dev and contains user-submitted content.
User content never shares scopeweb.io's cookie scope or its blocklist reputation. If someone abuses a preview, the damage is contained to this domain: a blocklisting here does not follow the API, the MCP endpoint or the main site. Same reason Vercel ships to vercel.app. That is isolation, not an uptime promise — we do not control whether any of these stay reachable.
Every preview is served noindex with a Content-Security-Policy pinning form-action and connect-src to 'self' — the browser refuses credential exfiltration regardless of what the markup tries.
Drafts are scanned on every version for external form actions and brand-impersonating credential pages. Flagged drafts serve 451 and stop being reachable.
Seen a preview here doing something it should not? Tell us and it gets reviewed. A takedown removes the content from storage, not just from view.
No account needed. Reports are rate-limited per IP and logged.