Delta developer platform
Runtime security
Uploaded JavaScript is hostile until proven otherwise.
Isolation
Games render in a sandboxed iframe without same-origin access. The runtime receives no platform cookies or tokens; privileged operations cross a typed postMessage bridge and are checked by the host.
Server trust
The server validates every account, save, score, achievement, project, and publish payload. Hiding a button is never authorization.