# Security and limitations

> PicassoWeb opens untrusted pages in Chromium. Its defaults reduce network risk, but the caller still controls what is inspected, written, and reused.

## Network safeguards

- Only HTTP and HTTPS target URLs are accepted.
- URLs containing embedded credentials are rejected.
- Localhost, private, link-local, and reserved network ranges are blocked by default.
- Redirects and browser subresource requests are checked by the same network guard.
- `analyze_html` blocks external network requests.
- Navigation time, input sizes, DOM sampling, selector matches, CSS collection, and returned HTML are bounded.

## Inspect a trusted local site

Pass `allowPrivateNetwork: true` only when the target is a trusted local development service:

```json
{
  "url": "http://127.0.0.1:3000",
  "allowPrivateNetwork": true
}
```

Keep this setting disabled when tool inputs can be influenced by untrusted users or content.

`compare_replica` treats the replica differently: `allowPrivateReplica` defaults to `true`, allowing the expected workflow of comparing a public original against localhost or a local file. The original URL remains guarded.

## Filesystem writes

Several tools accept an absolute output path and write evidence there. Choose a dedicated directory, review generated files before executing or publishing them, and avoid sensitive locations.

Downloaded assets are the files served by the target website. PicassoWeb does not determine whether you have permission to reuse them.

## Practical limitations

- Authentication, cookie consent, CAPTCHAs, and anti-bot systems are not bypassed.
- User-specific content may require a separate authorized browser session before analysis.
- Component-family recognition is heuristic; use `inspect_component` for exact follow-up evidence.
- `extract_animations` is a settled static census, not a recording of the complete JavaScript timeline.
- `capture_motion` samples real wall-clock time, so very fast animation may produce few distinct frames.
- `extract_layout` provides stacking evidence and DOM order, not the browser's complete global paint order.
- `crawl_site` follows standard anchor links only and intentionally limits page count and depth.
- Pixel comparison can still contain noise from canvas, video, WebGL, timers, live data, and nondeterministic rendering.

## Responsible use

Inspect websites and reuse assets only when you have authorization. Treat downloaded code, media, branding, and typography as potentially copyrighted or licensed material.

PicassoWeb provides replication evidence. It is not a license or a mechanism for bypassing access controls.

## Next

- [Return to the documentation overview](index.md)
- [Follow a measured replication workflow](workflows.md)