ProtoLens is operated by MyAgentHubs. This page describes implemented controls in the managed service and their limits.
Prototype isolation
Managed HTML prototypes render on a separate content domain inside an iframe with sandbox="allow-scripts", without allow-same-origin. The content response also applies a sandbox Content Security Policy (CSP). Inline prototype scripts can run, while the CSP blocks fetch connections, remote subresources, nested frames, workers, objects and form submissions. Images and media are limited to embedded data/blob sources; fonts to data sources.
Preview access uses a short-lived capability tied to a version and a live share or owner work. Stored HTML is checked against its recorded digest before serving. These controls are not a guarantee that uploaded content is safe: sandboxed self-navigation remains a possible external path. Do not enter credentials or sensitive data into prototypes.
Tokens and connections
Managed session, authorization-code, access, refresh, share, participant and preview tokens are stored as SHA-256 hashes. Short-lived upload tickets are an exception: their issued values are stored for upload authorization. Keep review links and connection credentials private.
MCP clients can use OAuth authorization with PKCE S256. Owners can also create temporary connections; the console offers 15, 60 or 240 minutes, with 60 minutes as the default. The API accepts whole-minute durations from 1 to 240 minutes. Expired or revoked connections are rejected.
The own access scope limits a connection to works it creates. The all access scope covers all managed works in the same account, now and in the future. Tool permissions are also checked. Owners can revoke connections and share links; preview access checks the underlying live share or work.
Review privacy
Before submission, a saved draft is accessible through that participant's identity and is not included in owner or AI feedback reads. Submission makes it available as review feedback to the owner, authorized AI connections and holders of that review link. A reviewer nickname is not a verified identity.
Report a vulnerability
Email panda@myagenthubs.com with the affected URL or feature, reproduction steps and impact. Avoid including live tokens, credentials or other people's private content. This page makes no claim of compliance certification or a guaranteed response time.