Limits and safety of hosting AI-generated HTML

What does ilolink strip, and why?

Anything that could run code in a reader's browser. On ingest, javascript:, data:, and vbscript: URLs are dropped, and by default no arbitrary JavaScript runs — inline <script>, event handlers, and imported scripts don't execute unless you mark the doc trusted at publish time. Forms are made inert (form-action 'none'), so a pasted mockup can't post credentials anywhere. The reason is simple: you often publish HTML an AI wrote, not you, and it loads on a domain readers trust. Stripping the executable parts means a hostile or careless snippet can't phone home, redirect, or harvest anything.

What survives is the part you actually want: the CSS is kept. A landing-page mockup, a styled report, a pricing table — they render exactly as designed, because layout and styling aren't a security risk. It's the scripts that go, not the look.

Will my interactive app work?

Not by default — it renders frozen to static. JavaScript isn't executed, so the app looks right at the state it shipped in, but nothing runs: no click handlers, no fetch calls, no state changes, no live charts. A counter won't count; a form won't submit; a tab won't switch. If you mark the HTML doc as trusted at publish time, it's kept as-is and its own scripts do run — contained in a sandboxed, opaque-origin iframe on the isolated view.ilolink.com origin, so the app works while still unable to touch cookies, storage, or other docs.

If you need interaction, build or export to static first. Pre-render the view you want people to see and publish that. For most AI output — landing pages, design mockups, dashboards-as-images, write-ups — the static render is the whole point, and it comes through faithfully.

What's the size limit?

15 MB per doc — that's the raw pasted body or the dropped file. Images are allowed inline, and an AI-generated image can be embedded in an HTML or Markdown doc and published, as long as the whole thing fits under the cap. If you're over it, compress heavy assets: shrink or re-encode images, drop giant base64 blobs, and strip unused CSS the model left in. Most single-page mockups and Markdown docs are well under 15 MB once the images are reasonable.

What isn't supported yet?

Being blunt about the edges, so you don't plan around them:

• Audio and video hosting — not live. Format-specific metrics (per-slide, per-PDF-page, spreadsheet, watch-through, listen-through) are roadmap, not shipped. Don't plan around per-slide analytics today.
• Version rollback or history — docs are immutable. One version per link. If content changes, you publish a new doc and share the new link.
• Custom domains — not offered. Links live at ilolink.com/<slug>.

What is live is the read side: cookieless views and approximate uniques, average time on page, a scroll funnel bucketed at 0 / 25 / 50 / 75 / 100%, referrers, countries, device class, 30-day daily views, plus click and scroll heatmaps, reactions with notes, and threaded comments. See analytics, heatmaps, and feedback for the full set.

Is it safe to paste AI HTML I didn't write?

Yes — that's the design point. HTML you didn't write is exactly the untrusted case ilolink is built for. It's sanitized on ingest (scripts stripped, dangerous URLs dropped, forms inert) and then served isolated on a separate render origin, view.ilolink.com, under a strict content-security policy (default-src 'none'). The branded ilolink.com/<slug> link 302-redirects there, so the doc never runs on your main domain and can't reach back into it. You get the rendered page; you don't inherit the model's mistakes.