Sure, happy to share a few of the gory details. Yep, Observable runs user JavaScript code, but that code has no access to your login credentials or anything fr

Sure, happy to share a few of the gory details. Yep, Observable runs user JavaScript code, but that code has no access to your login credentials or anything from the 'application': user code runs in a sandboxed iframe on a separate host - host that doesn't have any cookies or user information. The application communicates with that iframe host through serialized postMessage information only. That's the gist of the 'user code' portion - the rest of the application has additional layers of best-practice security like very strict content security policies and so on that defend from other kinds of attacks.