Liquid safety and limits

Upstorr Liquid is intentionally narrower than unrestricted server code.

Rendering limits

• A Liquid source may contain at most 500,000 characters.
• A render may use at most 1,000 output/render operations.
• Liquid rendering has a 2,000,000-unit memory budget.
• A section has a 20,000-step work budget for loops and template work.
• A block tree supports at most eight nested levels and 200 installed blocks.

These limits protect every storefront from one accidental section freezing the page.

HTML safety

Rendered HTML and URLs are validated. Script tags, inline event handlers, unsupported editor attributes and unsafe URL forms are rejected. Rich text must pass through the approved sanitizer.

Platform boundary

Liquid cannot read cookies, secrets, files or database tables. It cannot call an Upstorr endpoint. It receives prepared public data and produces presentation HTML.

Put advanced browser interactions in theme/assets/theme.ts. Use @upstorr/theme-sdk/v1 for documented navigation and commerce actions. If the SDK lacks an action, that is a shared platform-contract gap—not permission to create a private theme shortcut.

Error behavior

Variables and filters are strict. Fix the named variable, filter, line and column rather than hiding the error. Empty legitimate store data should be handled with a Liquid condition and an honest empty state.