How Scene by Zaweba keeps your data feeds safe
Scene by Zaweba's feeds send only what you typed, with no cookies, strict limits, and keys stripped when you export a scene. Here's what that means.
A data feed widget is a small program fetching things from the internet on your behalf, so it's fair to ask what it sends and where. Scene by Zaweba keeps feeds deliberately narrow. Each one sends only the address and headers you typed, carries no cookies, has firm limits on time and size, and runs only while a scene with a feed widget is switched on.
Feeds are one of Scene's most useful features: a live figure from any web address that answers JSON, such as orders today for a small shop. They're also the part of Scene that touches the network most, so the safety rules are worth knowing.
What a feed sends
Only what you put in it: the address, and any headers you added, typically an API key. No cookies are sent, so a feed can't ride on a login you happen to have in a browser. There's no hidden identifier and no account. Scene has no telemetry; its network use is weather and the addresses you type.
The limits
Every fetch has a 20 second timeout, so a slow or stuck server can't hang a widget. Replies are capped at 1 MB, which is plenty for any sensible JSON or plain text reply and stops a wrong address from pulling down something huge. Up to 3 redirects are followed, enough for ordinary moves between addresses but not an endless loop.
Refresh has a floor of 30 seconds, with 5 minutes as the default. That keeps a widget from hammering a service, which matters for APIs that limit how often you can call them.
When feeds run, and when they don't
Feeds run only while a scene with a feed widget is on. Switch the scene off, or switch to one without feeds, and they stop. A feed with no address shows Set the address in Edit and asks nothing at all, which is why the Control panel scene's example feeds (Orders today, Low stock and Revenue today) are quiet until you fill them in.
When something goes wrong, the widget tells you plainly. It shows loading, the time of the last good reply, an amber Stale when the figure is out of date, and short errors like Not allowed (401), while keeping the last good value on screen.
Sharing without leaking keys
The thing people most worry about is sharing. You've built a lovely dashboard scene with your shop's API key in a header, and a friend asks for a copy. When you export a .zscene, Scene strips the headers and key-like parts of addresses, so the file doesn't carry your keys. Your friend sets their own.
Imports have their own guard rails. Scene refuses file names with .. or drive letters, never accepts programs, limits a .zscene to 300 MB and 2000 files, validates the scene and renames it if its id clashes with one you have.
The wallpaper can't phone home
Feeds are fetched by Scene itself, not by the wallpaper. Wallpaper pages are blocked from the internet entirely; everything outside the scene's own folder is off limits. So a shared scene's animated wallpaper can't quietly call out, even if someone wrote it to try.
Good habits
Use read-only keys where a service offers them; a widget only needs to read a number. Keep the refresh as long as the figure allows. And use Test the feed now in the editor to check a new feed before relying on it. Together with Scene by Zaweba's own limits, that keeps a live dashboard on your desktop without opening anything up.
