# Apps run on their own domain, apart from your sign-in

> Every app now loads from its own address on generalinputusercontent.com, so nothing inside an app can act with your General Input sign-in.

Oct 22, 2026. Topics: Apps, Security. https://www.generalinput.com/changelog/2026-10-22-apps-run-on-their-own-domain

Apps your specialists build now load from their own web address, one per app, on generalinputusercontent.com. Your browser treats each app as a separate site from General Input itself, so nothing running inside an app, whoever wrote it, can act with your sign-in or reach into another app. Apps look and work exactly as before: in the dashboard, in white-label workspaces, and in the [mobile app](/mobile).

### How it works

- **One address per app.** Each app gets a subdomain of its own, so two apps never share an origin or the storage a browser keeps for a site, and an app's page is served only from its own address.
- **Your sign-in never reaches an app.** The domain is separate from generalinput.com, so the browser never sends General Input's sign-in cookie to an app page, and General Input's own address no longer serves app pages at all.
- **Existing apps need no rebuild.** Apps load their files and call their handlers by relative paths, so every published app moved over as it is.
- **Uploads keep working.** Files an app uploads still go straight to storage through signed links, now from the app's own address.

### Also shipped

- An agent opening an app to check its work loads it from the same address people do.