App gallery

The gallery is the community layer: publish an app you’re proud of, browse what others have built, and download anything that looks useful — it runs locally against your live data the moment it lands.

Publishing

• Publish from an app card’s menu on the dashboard: add an optional description (280 characters) and go.
• Only the index.html is uploaded — no folder contents, no keys, no session files.
• Published apps appear under your username (set it in Settings) with your chosen name, agent, and a download counter.
• You can publish up to 50 apps and unpublish any of them from the My published tab.

Browsing & downloading

• Browse Recent or Popular (by downloads); each card shows name, author, agent, and description.
• Download copies the app into your dashboard and opens it in preview mode, wired to your own data connection — no setup.
• Downloaded apps are fully yours: open them with an agent, remix, and re-publish your own take.

The trust model

Before your first download, cvforge shows a plain-language confirmation: a downloaded app runs locally with access to your live options data, so download from people you trust. Two design choices back that up:

• Apps can’t exfiltrate. The preview sandbox blocks all network access except the local data proxy and a few chart/font CDNs, and WebRTC is disabled. A malicious app has nowhere to send your data.
• Apps never see credentials. API keys are injected by the local proxy outside the page; there is nothing in index.html to steal.
• Everything is a single readable HTML file — you (or your agent) can inspect exactly what a downloaded app does.