Hosting arbitrary HTML is hosting arbitrary JavaScript
the problem
A paste is a full page with scripts in it. Serve all pastes from one domain and any one of them can read the cookies, storage and DOM of every other. The service becomes a hosted cross-site scripting platform.
what I did
Each paste is served from its own origin, so the browser's own same-origin policy does the isolation rather than a sanitiser I would have to keep ahead of. Sanitising untrusted HTML is a losing race; giving it nothing worth stealing is not.
Link previews need per-page tags
the problem
A shared link should preview as the page it points to. But the page belongs to the user, who did not write Open Graph tags, and injecting them into their markup would mean rewriting their document.
what I did
Crawlers are detected at the edge and rewritten to a separate function that renders OG tags for that paste, while human visitors get the untouched document. The user's HTML is never modified. The crawler gets a different response.
One publish path, four entry points
the problem
A drop zone, a paste box, a REST call and an MCP tool are four different clients. Implementing publishing four times guarantees they drift apart, and the agent path, the one I most wanted, would be the least tested.
what I did
All four are thin shells over a single Convex function. Whatever works from the browser works identically from curl and from an agent, because it is the same code path.
