This domain hosts draft site previews for Scopeweb. Each preview lives at {draft-id}.scopedraft.dev and contains user-submitted content.
User content never shares scopeweb.io's cookie scope or its blocklist reputation. If someone abuses a preview, this domain absorbs it and the API, the MCP endpoint and the main site stay up. Same reason Vercel ships to vercel.app.
Every preview is served noindex with a Content-Security-Policy pinning form-action and connect-src to 'self' — the browser refuses credential exfiltration regardless of what the markup tries.
Drafts are scanned on every version for external form actions and brand-impersonating credential pages. Flagged drafts serve 451 and stop being reachable.
Seen a preview here doing something it should not? Tell us and it gets reviewed. A takedown removes the content from storage, not just from view.
No account needed. Reports are rate-limited per IP and logged.