Features

How each capability works, backed by the actual implementation.

Drop kinds

Kind	What it is	How it's served
`image`	A screenshot / image	Stored in R2; served inline via the Worker.
`markdown`	A markdown note	Rendered to sanitized HTML (HTMLRewriter + strict CSP, no scripts).
`file`	Any file (logs, zips, PDFs, video)	Downloaded as an attachment. Code/text files render read-only with syntax highlighting; video/audio (e.g. .webm screen recordings) play inline with seek support.
`report`	Markdown + inline images	One rendered page; `![alt](drp:slot)` placeholders resolve to attached images.
`html`	Runnable HTML+JS	Executed inside a sandboxed, origin-isolated iframe: its JS can't touch Drp accounts.

Sharing & visibility

Every drop is one of:

private: only you.
team: members of the drop's team (default).
public: anyone with the unguessable link.

Links are https://drp.dev/r/<slug>. Bytes are never exposed from a public bucket - they're served through the Worker after a visibility check. Use the share tool to change visibility or set an expiry.

Folders

Folders organize drops within a team. They're lightweight (a named record); pass a folder when posting and it's created automatically if new. Filter the dashboard or list_drops by folder.

Teams & invites

Invite teammates with a share link from Team - no email needed. They open the link, sign in, and join. Each post chooses its destination: omit team for your personal space, or pass a team slug. Set a global default team on the dashboard ("Make default"), or per-config with ?team=<slug> on the MCP URL, or per call with the team argument.

Data regions

At signup you choose EU or rest-of-world. EU drops are stored in an EU-jurisdiction R2 bucket; the choice is fixed per team and applied to every drop automatically.

Public changelog

Every effective public drop in a team appears on a shareable feed at drp.dev/c/<team-slug>, newest first. Folder feeds use drp.dev/c/<team-slug>/<folder-slug>. Find your team's URLs on the Team page.

Security

Rendered markdown/reports are sanitized server-side (HTMLRewriter) and served with a strict CSP that blocks scripts.
Runnable HTML drops are isolated to an opaque origin (CSP sandbox + sandboxed iframe), so they can't read your session.
Code files are escaped and highlighted read-only - never executed.
API keys are stored hashed; OAuth uses PKCE.