Limitations

An app is static files from a repository, run in a sandbox. That is what makes publishing one quick, and it is what everything below follows from.

Can’t	Because	Instead
Run backend code	Stackboard runs no build and no server	Move logic to the browser, or call an existing API
Store data	Nowhere to write, and the sandbox blocks browser storage	Write through an API. State that must persist lives in another system
Hide anything in the repository	Every file it serves is downloadable	Store credentials as secrets, which never reach the browser
Call an API you have not configured	The sandbox limits network access to the targets you add	Add an API target for each origin you call
Run scheduled work	Code runs only while a tab is open	Use your existing job scheduler and display the results
Serve a large file	The entry document and the files it names share a 20 MB budget	Keep large media elsewhere and reference it by URL

Danger

Every file Stackboard serves is published to everyone with access to the app. Secrets belong in Stackboard, where they are attached server-side and never reach the browser.

Network access

The page runs sandboxed and can reach only the origins you add as API targets, so every API you call needs one. Each target is called either by Stackboard, which attaches your stored key on the way out, or by the viewer’s browser, which is how you reach a host that exists only on your own network. See Adding data.

Rough test

If the app would keep working with the network unplugged after it loads, it fits. If it needs to remember something or work while nobody is watching, it doesn’t.