A vault app can load images and scripts from a site but cannot fetch its data

OpenLowGapdev.vault.sgraph.ai

What we saw

The host CSP is connect-src blob: data:. fetch() to newsroom.sgit.ai is refused although it sends access-control-allow-origin *, while <img> and classic <script src> from the same origin load.

Why it matters

Builders reasonably expect CORS-open data to be readable and discover otherwise in production; apps must snapshot data instead.

The fix

Snapshot the data into the vault (with SHA-256 in sources.json) and say in the UI which copy is shown. State the CSP where builders read about vault apps.

The record

Status	Open
Severity	Low
Kind	Gap: something the reader needs is not there
Product	dev.vault.sgraph.ai, platform
Where	vault apps reading newsroom.sgit.ai
Problems	Host trap
Visibility	Silent: no symptom on screen: found only by measuring, or by its consequences
Recommendation	Design for the host: use the host's own mechanisms (route variable, sg.state, vault snapshot) instead of the browser's defaults
Area	Platform
Breaks	A vault app works inside the host, not just on its own
Observed	2026-10-11, host
Last checked	2026-10-11, host
Source	Design lab: what building it measured

Previous: UX-047 localStorage throws inside the vault app frame, so reader data is lost on reload

Next: UX-049 Query strings break inside the vault host, so filters must live in the route path