Skip to content
Documentation

Security

Sharing safely

Who can open a preview link, how password protection works, what Localians does to protect your computer, and how to switch sharing off.
Public previews can be opened by anyone with the link. Turn on password protection to restrict access.

Public or password protected

Every project is public or password protected, and its preview links follow that setting. Choose it in the Share App wizard, or on the project page under Preview access. Changes apply immediately, including to links that are already live.

  • Public: anyone who has the link can open the app while you share. Links are long and random, so they can't realistically be guessed — but they can be forwarded or pasted into chats.
  • Password protected: visitors see a Localians password page first. The same protection covers pages, API calls and WebSockets (hot reload, live updates). Nothing reaches your app until the password is right.

How password protection works

  • Passwords need at least 8 characters and are stored only as a salted scrypt hash. Localians can't show you the password later.
  • After the right password, the visitor's browser gets a signed cookie for that one preview link. It isn't sent to your app.
  • Visitors stay signed in for the time you choose (1 hour to 7 days). Changing the password or Sign out all visitors ends every visitor's access at once.
  • Wrong guesses are rate limited per visitor and per preview, so passwords can't be brute forced quickly.
  • Send the password separately from the link (for example, link by email, password by chat).

What not to share

A password lowers the risk but doesn't make a development server production-ready. Avoid sharing:

  • Apps connected to real customer data, production databases or real payment keys.
  • Admin panels or tools without their own login.

Use test data, and keep your app's own login for anything sensitive.

What Localians protects

  • Visitors only reach the one port you shared, on your own computer — never other ports or other machines on your network.
  • You never open ports on your router: the CLI makes an outgoing, encrypted connection.
  • Localians' own cookies are removed before requests reach your app, and forwarded-for headers can't be spoofed.
  • The CLI uses its own revocable token, never your dashboard session, and never prints it.
  • Requests, connections and bandwidth are limited per preview and per workspace to prevent abuse.
  • Localians stores connection times and traffic totals, not page contents, request bodies or cookies.

Your computer must stay online

The preview is served from your machine. If your app stops, your computer sleeps, or you close the share command, visitors see an “isn't running” or “isn't active” page — never a stale copy. Localians isn't a hosting service.

Stopping and revoking

  • Stop one preview: Ctrl+C in its terminal, or Stop Sharing in the dashboard. The link stops working immediately, can't reconnect, and is never reused.
  • End visitor access but keep sharing: change the password, or use Sign out all visitors.
  • Revoke a computer: Settings → CLI → Revoke, or localians logout on that computer. Everything it was sharing stops.
  • Automatic limits: a share lasts at most 24 hours by default, CLI logins expire after 90 days, and dashboard setup commands work once within 30 minutes.