MoleSignal shares a specific dashboard or report. A share link never becomes a normal user token.
Share modes
Public-link protections
The opaque /s/{token} link is exchanged for a short-lived, HttpOnly share session. Public
dashboard requests can run only saved panel queries through a constrained proxy. The browser
cannot submit arbitrary SQL or PromQL.
A share can enforce:
- expiration;
- maximum view count;
- password (required for dashboards; workspace policy decides for reports);
- download permission;
- fixed dashboard time-range and variable constraints;
- revocation and token rotation.
Public dashboard downloads are disabled. Public report downloads follow the share and workspace
policy.
Workspace policy
Open Settings → General → Sharing and public access to control:
- whether public links are allowed;
- whether live dashboards can be public;
- maximum public-link lifetime;
- required passwords for public reports;
- blocking public shares for resources tagged
production or prod;
- public CSV downloads.
Use an authenticated or cross-workspace share when public policy blocks the resource.
Audit and revocation
Share creation, access, rotation, and revocation are audited. Revoke a share to stop future
sessions, or rotate the share when the URL may have leaked.
The resource share permission, such as dashboards.share, is required. MoleSignal re-authorizes the
source resource before creating a share.
A public URL is still a bearer credential. Do not place sensitive data in the shared view, even
when the link expires or uses a password.
