# Limitations & FAQ

## Architectural — will not work, by design

The whole app runs inside the recipient's browser tab. Anything that needs
the outside world, or another process, does not travel:

- **Outbound network calls from views** (payment APIs, external services).
- **WebSockets, Celery, cron** — there is no second process.
- **Postgres / MySQL / Redis** — only the bundled SQLite snapshot exists.
- **Shared state between viewers** — each recipient gets a private copy;
  writes persist across clicks and reset on reload.
- **Compiled dependencies** not built for WASM (psycopg2, mysqlclient, …).
  The build warns when it spots these in `requirements.txt`.

## Current gaps — may improve in future releases

- **File uploads** — file inputs are ignored on submit.
- **CSS `url(...)` references** — stylesheets are served and `<link>`,
  `<img>`, and `<script>` static references are rewritten, but URLs *inside*
  CSS files (background images, font faces) are not yet rewritten.
- **Browser history** — the back button navigates the outer page, not the
  app; routing happens inside a single iframe.
- **FastAPI sync endpoints** — `def` (non-async) endpoints run inline on
  the event loop instead of a threadpool (WebAssembly has no threads).
  Fine for demos; prefer `async def`.
- **Secret scrubbing is Django-shaped** — only Django's `settings.py`
  `SECRET_KEY` is rewritten. A Flask `app.secret_key` or FastAPI settings
  constant in source ships as-is; keep real secrets in `.env` files (which
  are always excluded) and check `--dry-run` before sharing.
- **Absolute self-links** — `url_for(..., _external=True)` and other
  absolute URLs open in a new tab as external links instead of navigating
  the demo.

## FAQ

**Does the viewer need to install anything?**
No. A browser and internet on first load: the Pyodide runtime (~10 MB) and
the Django wheel come from public CDNs and are cached by the browser.

**Is my data safe to share?**
The file contains your code and your SQLite snapshot, readable by anyone
who has it. The scrubber removes `.env` files, credential-named files, and
`SECRET_KEY`, and reports everything it did — but you are shipping your
data. Run `--dry-run` and look before you send.

**Why does the demo say CSRF is disabled?**
Form posts inside the artifact go through Django's test client with CSRF
enforcement off and `DEBUG = True`, so the demo is friction-free and errors
are readable. The artifact is a demo, not a deployment.

**The artifact loads Pyodide from a CDN — what about integrity?**
The `<script>` tag carries no Subresource Integrity hash: the Pyodide
version is configurable at build time (`--pyodide-version`), and Pyodide
itself fetches further assets (the WASM binary, wheels) dynamically, which
SRI cannot cover. If your threat model requires it, pin a version, add an
`integrity` attribute to the emitted HTML, and host the runtime yourself.

**How big can my app be?**
Every bundled byte becomes ~1.33 bytes of base64 in the HTML. sharepack
warns when the payload exceeds 20 MB — a 50 MB dev database makes a ~67 MB
HTML file that mail servers will bounce. Share a trimmed database.