What does not work
Solta serves static files. That is a real limit with a real edge, and it is better to know where it falls before you paste something than after.
No server of your own
No PHP, no Node, no Python, no database. Nothing of yours runs when somebody opens the site — the browser gets files, and whatever your JavaScript does, it does there.
This is not a gap we are getting to. Every security property here comes from that one decision: untrusted content is static bytes on an isolated origin. Running somebody else's server code would mean per-tenant sandboxes, resource limits and egress control, and it would stop being the thing that is safe to embed on your own website.
No secrets in the file
Anything in the file is readable by anyone who opens the site — that is true of every static site, and it is why we refuse files with API keys in them rather than publishing and warning.
A site that needs to call a model is the exception, and it is the only one: your key is held here, the page asks its own origin, and the key is never in anything a visitor can read. Every other kind of key still needs a server of your own, which is the previous section.
Things that surprise people
- Imports from npm work — React, Tailwind and shadcn/ui components are handled for you. Solta rewrites the import to a pinned version, and the browser fetches it from
esm.shwhen somebody opens the site. So a visitor's browser talks to esm.sh as well as to us, and a package that is not on esm.sh will not resolve. - Fetching an API from the site works, as long as that API allows it. Their CORS policy decides, not ours.
- Local storage works, and is per site — each one has its own origin, so two sites cannot read each other's.
- A file that compiles but throws when it runs publishes, and shows whatever it drew before the error, often a blank page. The browser's console says why; A blank page walks through it.