You’ll need your own domain first
Custom code only runs on your own domain. On astashed.one address, it won’t
run at all.
The short version: on our domain, every shop shares one origin with every other
shop and with the dashboard, so a script there could read other merchants’
sessions. On your own domain, your script only ever touches your own site and
your own shoppers — which is the deal you’re signing up for anyway.
→ Set up a custom domain
Your code runs exactly as you wrote it
We don’t sanitise it. There’s no sensible way to sanitise a script you’re explicitly asking us to run, so what you save is what executes. Three things follow from that:A third-party snippet can see everything on the page
A third-party snippet can see everything on the page
A chat widget or analytics tag can read what your shoppers are looking at and
send it wherever it likes. Only paste snippets from people you’d trust with
that.
A typo can take the page down
A typo can take the page down
Nothing checks your syntax before it ships. Save, then open your shop with
the browser console up.
Anything you put here is public
Anything you put here is public
Every visitor can read it. API keys, tokens and private URLs don’t belong in
custom code.
Two that catch people out
If you’re adding your own structured data, escape it properly.JSON.stringify
won’t escape a </script> inside a string, so a product description containing
one can break out of the block.
Check the settings first
Quite a lot of what people reach for custom code to do is already a setting:Appearance
Colours, logo, theme, policy pages.
Page builder
Sections, layouts, product grids.
SEO & social
Titles, descriptions, link previews.
Apps
Integrations that don’t need a script at all.