Cross-site distribution
Embeds Guide
Embeds extend a vibe beyond vibecodr.space while preserving sandbox boundaries, canonical identity, live-vs-exact artifact behavior, and performance expectations.
Distribution playbook for secure and stable cross-site vibe embeds.
Implementation focus
Use this before enabling external distribution so embed behavior matches trust and publication policy.
Expected outcomes
- Deploy embeds without weakening sandbox isolation.
- Keep canonical app identity across first-party and third-party surfaces.
- Understand pinned versus live behavior for shared experiences.
Embed identity
Embeds let a vibe travel outside Vibecodr while preserving its app identity, sandbox policy, and release behavior. The embed should still connect back to the canonical public app instead of becoming an orphaned copy.
Live embeds can follow the current Drop, while exact embeds can pin a specific artifact. The right choice depends on whether the host wants the newest version or an immutable reference.
- Use live behavior when the host expects updates to flow through.
- Use exact artifact behavior when documentation, tutorials, or audits need reproducibility.
- Preserve sandbox and frame boundaries even when the embed is distributed widely.
Safety expectations
Embedded code is still user-authored runtime content, so it must stay isolated. Embed delivery should not weaken CSP, frame, CORS, CORP, or sandbox assumptions to accommodate a third-party host.
External distribution should increase reach without increasing trust.
- Keep runtime execution inside the intended frame boundary.
- Do not expose owner-only source or backend metadata through embed markup.
- Keep canonical links and attribution visible enough for viewers and crawlers.
Example and read next
Example: a customer wants to place a vibe in a docs site. Use a live embed when updates should follow the current Drop, and use an exact artifact reference when the docs need reproducible behavior.
Use these related pages when you need the next layer of guidance. They point to the most likely follow-up tasks, not every page that happens to touch the same system.
- Read next: Source & Versions (/docs/source)
- Read next: BUMP IT (/docs/bump-it)
- Read next: Approved CDNs (/docs/approved-cdns)
- Read next: Vibes & Pulses (/docs/vibes-pulses)