# Fonts & Assets: How files are served

> The security headers on page files.

Glider documentation · Building Graphics · Web page: https://cgglider.com/docs/assets/serving/

Sections of this page: [Files & folders](https://cgglider.com/docs/assets.md) · [Fonts](https://cgglider.com/docs/assets/fonts.md) · [Limits](https://cgglider.com/docs/assets/limits.md) · [How files are served](https://cgglider.com/docs/assets/serving.md)

Page files are served from /<pageId>/files/<path> with a deliberately tight policy: nosniff, SAMEORIGIN framing, and a Content-Security-Policy allowing only same-origin images and media with inline styles — no scripts, no objects, no forms, no outbound loads.

> **Note:** That is why an uploaded asset can never execute, even if it contains script. It also means an SVG referencing an external resource will render without it.