Studio Protocol security
An Element contains executable React source code and may declare npm dependencies. Studio requires confirmation before applying an Element delivered through drag-and-drop or an installation request.
Allowed origins
Any HTTPS website can request an Element installation confirmation. HTTP is supported only for local development pages on localhost or 127.0.0.1.
Studio reflects only the requesting allowed origin in CORS. It does not use wildcard CORS or cross-origin credentials.
Confirmation boundary
Elements delivered using setStudioDragData() or installInStudio() require confirmation in Studio. A successful installInStudio() result only means the request reached Studio and is awaiting confirmation.
Before confirming, Studio shows the target composition and destination file, source code, and every declared dependency with its installation status. For an installation request, Studio also shows the requesting website. Drag-and-drop data has no reliable website provenance and is labeled as unverified. Source code and package lifecycle scripts run with the project's file and network access.
Declining the confirmation does not write source files or install packages.
Target information
Discovery exposes limited metadata needed to present the destination: project name, composition ID, Studio version, focus time, and a short-lived target token. It does not expose project source code or filesystem contents.
Target tokens are opaque, single-use, short-lived, and bound to the requesting origin, selected Studio tab, and composition.