Safety rules

Ondaclip checks these rules on every shoot. If a rule fails, the shoot stops with a clear message.

• Only the environment you chose. The demo accounts declare it, and the app URL must match devGuard.appHostPattern. DEV by default.
• Read-only by default. Writes to your API (apiPattern) are blocked. A tutorial that needs to write lists its paths in writes and undoes them in cleanup.
• Fictitious emails only. Emails typed in a tutorial must match safeEmail, for example @example\.com$.
• Nothing private on screen. With neverShow, a shoot stops when any text you list, or a demo account’s email, is visible and not covered by hide. The message says where it appeared, never the value itself.
• No secrets in the repository. Demo accounts are stored encrypted: by Ondaclip on Ondaclip Cloud, or in your project’s Secret Manager on your infrastructure. They’re used only to sign in during your shoots and are never shown, not even to you. They never appear in logs or videos.
• Your data stays separate. On Ondaclip Cloud, your workspace is isolated from other customers, and Ondaclip keeps nothing from a shoot except your videos and what your review needs. On your infrastructure, shoots, files and voices run in your Google Cloud project. See where it runs.