PRIVACY SHIELD & MULTI-TENANT ISOLATION
Origin Sandboxing & Firestore Ownership Rules
How MyfaPost Creator OS isolates untrusted tenant HTML5/JS pages from the control-plane authentication session and enforces strict UID document ownership.
Host-Only Authentication Scope
Firebase Authentication tokens are stored strictly inside IndexedDB on the apex myfa.page origin. No wildcard Domain=.myfa.page cookies are ever issued, ensuring tenant scripts on *.myfa.page have zero access to creator credentials.
Per-Subdomain Browser SOP Sandbox
Under the browser Same-Origin Policy (SOP), hacker.myfa.page and cyberpulse.myfa.page are distinct security origins. Custom JavaScript inside a user's index.html is completely sandboxed to its own subdomain.
Reserved System Namespace Registry (34 Protected Handles)
The following system handles are blocked at both the Next.js Edge Middleware layer and inside firestore.rules:
www.myfa.pageapp.myfa.pageapi.myfa.pageadmin.myfa.pagedashboard.myfa.pageauth.myfa.pagelogin.myfa.pagesignup.myfa.pagemanage.myfa.pageposts.myfa.pagelessons.myfa.pagetemplates.myfa.pageaudience.myfa.pageanalytics.myfa.pageshowcase.myfa.pagestatus.myfa.pagewhitepaper.myfa.pagesecurity.myfa.pagechangelog.myfa.pagemail.myfa.pagesmtp.myfa.pageftp.myfa.pagecdn.myfa.pageassets.myfa.pagestatic.myfa.pageroot.myfa.pagesystem.myfa.pagesupport.myfa.pagehelp.myfa.pagebilling.myfa.pagevercel.myfa.pagefirebase.myfa.pagemyfa.myfa.pagemyfapost.myfa.page