Publishing, access, and security

Two delivery models

Internal Publisher hosts the authenticated Lunar Paper copy and supports embedding in Pages. External Publishers host anonymous copies through approved publisher instances.

Anonymous does not mean publicly reachable from every network. The external publisher’s network placement determines LAN or Internet reachability.

Internal access

Private, Restricted, and Internal audiences apply to the Internal Publisher. The service’s maximum access setting is the upper bound; a form cannot reach a wider audience than the service permits.

Authentication and service/resource guards are enforced on the server. Hiding a button in the browser is not an access control.

Versioned publishing

Publishing releases a saved form version through Lunar Paper’s unified publish model. A release note records what the change was for. The published link updates only after the destination succeeds.

Input and content safety

• Required, format, range, and conditional validation run in respondent flows.
• State-changing requests use the platform’s authentication, authorization, CSRF, rate-limit, and security-telemetry protections.
• Rich Text and display HTML pass through the shared safe-content path.
• Files and signatures use guarded opaque references and protected download routes.
• Provider-backed AI creation uses the platform AI provider service; provider credentials are never form fields.

Data minimization

Ask only for information the service process needs. Keep emergency, consent, retention, and contact guidance visible where relevant. Treat CSV exports and file downloads as service data, not as harmless form configuration.

Collaborate and configure access sets the audience; Publish, submit, and recover releases the version.