Data Apps run under a content policy
A Data App may load scripts, styles and fonts only from known CDNs and the origins you allow, and can't send its data anywhere else.
A Data App has the reader's query results in hand, so its frame now runs under a content policy. Data comes only from the SDK: fetch, XHR and WebSocket to other servers are blocked, and so are frames and forms.
A Data App is one self-contained file. Nothing it loads may be another file in your repo, so put your own scripts and styles inline, and images inline as SVG or a data: URI. Load libraries from jsDelivr or cdnjs, the SDK's built-in CDNs since 0.13.1.
To allow another origin, list it in .anfra/config.yml:
apps:
allow_origins:
- https://cdn.acme.comAn organization on anfra Cloud keeps its own list, and since 0.13.1 anfra publish says which of your origins it doesn't allow.