Public shareable links function as interactive read-only snapshots.

When a link is generated, a unique cryptographic token is mapped to the project’s current state in the database. The route serves this data to a canvas where all mutation logic and API write-access are disabled.

Key facts:

• Read-Only: Access is strictly limited to viewing and navigation. No data can be modified.
• Static State: It is not a real-time sync. The link reflects the project at the time of generation.
• Revocable: You can disable the link or regenerate the token at any time to kill previous access.

This is similar to how tools like Lufi or PrivateBin handle public access to specific resources without requiring authentication. And NoSQL/centralized backdoors 😅