Docs

Hosting

Serving the runtime and files: no external requests, caching, Content-Security-Policy.

No external requests. Everything the runtime needs is in your export. It never calls our servers.
Caching. Page files are named by their content, so they can be cached for a year (Cache-Control: public, max-age=31536000, immutable). element.json, t.json and m.json should be revalidated (no-cache).
Content-Security-Policy. The runtime decodes in a worker started from decode.js and the desktop transcoder starts its own worker: allow worker-src 'self' blob:.
Compression. The pages are already compressed; serving them gzipped again gains nothing.
Serve over http. Browsers will not load the runtime's modules from file://.