Sandbox Mode
Sandbox mode gives each visitor an anonymous guest identity, tied to an sb_sandbox cookie. Guests can create and edit their own presentations without creating a normal account. Use a separate sandbox deployment for a public demo.
Enable it
Section titled “Enable it”SANDBOX_MODE=trueSandbox presentations are stored in PostgreSQL. The default filesystem directories are server/data-sandbox and server/uploads-sandbox; SANDBOX_DATA_DIR and SANDBOX_UPLOADS_DIR override those defaults, while DATA_DIR and UPLOADS_DIR take precedence over both. These paths do not create a separate database: guest access is enforced through ownership and application permissions. DEMO_MODE is a separate flag and is not required for sandbox mode.
| Variable | Default | Purpose |
|---|---|---|
SANDBOX_TTL_HOURS | 24 | Age after which a guest presentation becomes eligible for cleanup |
SANDBOX_COOKIE_DAYS | 30 | Guest cookie lifetime |
SANDBOX_MAX_DECKS_PER_GUEST | 25 | Maximum presentations per guest |
SANDBOX_MAX_BYTES_PER_GUEST | 52428800 | Stored deck data limit per guest, in bytes |
SANDBOX_DEFAULT_THEME | editorial | Theme for new sandbox presentations |
SANDBOX_WATERMARK | Sandbox export • Created by an anonymous user | Text on sandbox output |
SANDBOX_MAX_TOTAL_BYTES is an optional soft monitoring threshold for all sandbox presentations. Reaching it logs a warning; it does not evict live presentations.
What guests can do
Section titled “What guests can do”A guest can open the curated examples, create presentations, and edit presentations they own. The guest is identified by a cookie and a database user row. With the defaults, the browser cookie lasts longer than the presentation lifetime, so returning with the same cookie does not preserve presentations past their TTL.
Sandbox mode disables sharing between people, public publishing, AI generation, and direct uploads. Settings that cannot be changed in the sandbox are disabled in the interface. The image library can still show bundled sandbox media; its contents are not a personal upload library.
Cleanup and limits
Section titled “Cleanup and limits”A cleanup job runs on startup and then about every ten minutes. It deletes expired guest-owned presentations that are not organization-visible, along with their dependent records. Curated organization-visible examples remain available. Expired guest user rows are removed after the cookie lifetime. The per-guest deck and byte limits reject new presentations when reached.
HTML, PDF, PNG, and printable notes exports carry a sandbox watermark. Editable data exports such as .deck do not gain a visual watermark. The editor also shows a sandbox banner with the presentation lifetime. The cookie is SameSite=Lax and uses Secure on HTTPS; it is not marked HttpOnly in the current implementation.