Deployment locks

Allowed origins#

Enter an exact address: https://app.example.com. Include scheme and custom port, with no path or wildcard. Add test sites too.

Set expiry in UTC. Test it and plan a replacement. Lock changes need a rebuild.

Once a running app sees that expiry, rolling its clock back does not unlock it. Reloading or editing client code can still bypass client locks.

Browser locks can be edited. Enforce important permissions on a server.

Server-side permissions and expiry cannot be bypassed by editing browser code.