HelixOverviewComponentsMapsGraphIntroductionInstallationDeriving a themeSandboxTheme builderVisual testingCortexDocsEngramBuildingTraceBuildingRecallDeclaredServicesInsightsGet in touchSource on GitHub
Acceptable useAcceptable useLast updated September 26, 2026. This policy covers /helix/sandbox and
/helix/theme, the two pages that run code you write. The policy is short,
because the way the sandbox is built prevents most misuse.Your code runs in your browserThe sandbox renders inside an iframe with sandbox="allow-scripts allow-forms"
and without allow-same-origin. Your code runs in your browser with an opaque
origin. It cannot read our storage, call our origin, or reach any of our
systems. Nothing you type is sent to a server, so there are no submissions to
moderate and no stored code to remove.As a result, most of what an acceptable use policy usually forbids cannot
happen here.What you may not doDo not use these pages to attack anyone, including us. This covers
scanning, probing, and using the frame to reach another system, however little
of it can work.Do not automate these pages at a scale that slows them down for other
people. The documentation is also published as plain Markdown beside every
page and as llms.txt, which is cheaper for you and for us than driving a
browser.Do not claim that Fusion endorses your work. Do not present the sandbox, or
anything made with it, as endorsed by Fusion, and do not imply that we
reviewed something we have not seen.A recommendationDo not paste a secret into the sandbox. You have no way to confirm that we
do not read it, and the habit protects you on any page. An API key in a code
sample also ends up in your clipboard history, your browser session, and any
screenshot you take afterward.What we may doWe may change or withdraw either page at any time. We may rate-limit or block
traffic that slows the site down. There are no accounts to suspend and no
content to remove, so these are the only actions we can take, and they apply to
the amount of traffic.If we ever host your codeThis policy holds because the sandbox runs entirely in your browser. If Fusion
ever runs the sandbox on your behalf, by storing your code or running it on a
server, that will need a different policy, with terms for retention, deletion,
and the law that applies to stored code.Contact usSend questions or reports of abuse to the address on the contact
page.