Guides · Safety
Is it safe to open an HTML dashboard someone emailed you?
The Dashfridge team · Updated November 7, 2026
What an HTML dashboard can do when you open it
- Run code. Charts, filters and tabs are JavaScript. That’s what makes the dashboard useful, and it’s also why it’s a program.
- Talk to the internet. A file opened in your browser can load scripts, fonts and images from other sites, and can send data to them. Usually that’s a chart library. Occasionally it’s something nobody asked for.
- Show you anything. Including a page that looks exactly like a Microsoft or Google sign-in screen.
What it generally can’t do
- Install software or read other files on your computer. Modern browsers block that.
- See your other browser tabs or your email.
The real risks for a small team
1. The numbers travel with the file. A dashboard file contains its data. Forward it once and your margins, payroll or customer list go with it, forever, with no way to take it back.
2. Quiet calls to the outside. If a dashboard loads something from a site you don’t recognize, that site learns that someone opened it, and a badly made (or tampered) file could send the data along.
3. Fake sign-in prompts. “Your session expired, sign in to view this report” is an old trick. A dashboard should never ask for a password.
4. Version confusion. Not a security problem, but the most common one: three copies, three different numbers, and a decision made on the wrong one.
A quick checklist
- Only open dashboards from people you know, and be suspicious of any that ask you to sign in.
- Ask your AI for a self-contained file with the data inside and no API calls.
- Don’t email files that contain payroll, customer or bank details.
- Share a link to one place people sign in to, instead of the file itself.
How Dashfridge handles it
We assume every dashboard could misbehave, so we lock all of them down the same way. Each one runs in a browser sandbox on a separate address from the one you sign in on, so it can’t touch your login. It can’t make network requests, post forms or load images from outside sites, so it can’t quietly send your numbers anywhere. And it’s only visible to people you invite.
| Emailed HTML file | Dashfridge | |
|---|---|---|
| Who can see the data | Anyone it’s forwarded to | Only people you invite |
| Can it send data out? | Yes, if it’s written to | No, network calls are blocked |
| Can it reach your login? | It runs on your computer | No, separate address and sandbox |
| Can you take it back? | No | Yes, remove access or delete it |
| Which copy is right? | Hard to tell | The certified one |
The details are on our security page.
Common questions
Can an HTML file give my computer a virus?
Opening an HTML file in an up-to-date browser runs it inside the browser’s protections, so it can’t install software or read your files on its own. The realistic risks are different: it can send data to the internet, show a fake sign-in form, or simply be forwarded to people who shouldn’t see the numbers inside it.
Is an AI-generated dashboard safer than one from a stranger?
Usually, but not automatically. AI tools sometimes add outside scripts, fonts or tracking without being asked, and a file can be edited after it leaves the AI. Treat dashboards as code, not documents.
What’s the safest way to share HTML dashboards at work?
Share a link to one place your team signs in to, where every dashboard runs in a sandbox that can’t reach your login or the internet, instead of sending files around.