# What mods can't do

> How Lucra keeps mods contained.

Source: https://www.onlucra.com/docs/mods-rules

> **Beta: needs approval.** Mods are in beta: ask Lucra for access to install one.

Mods are built so that a mod can't break, restyle or impersonate Lucra, and can't reach anything that moves money or grants access.

## What a mod can't do

- **Ship markup or styles.** A mod picks Lucra components and their props; class names, styles and anything that would place content outside the mod's area aren't offered.
- **Speak as Lucra.** Everything it shows sits under a label with its name; its messages carry its name; its error text never reaches a person.
- **Send people anywhere.** It can only open its own pages, never Settings, sign-out or another site.
- **Load what it likes.** Components that would fetch a URL a mod chose aren't offered; its server may reach only the hosts its `mod.json` lists, besides the Lucra API.
- **Ask for credentials.** Lucra refuses a form whose fields are named like passwords, tokens or card numbers.
- **Touch money, access or messages directly.** Payouts, billing, ad spend, sign-in, roles, keys and messages sent as people are sealed off from mods. A mod works through the Lucra API like any other app, with only the access it was installed with.
- **Run unreviewed code.** `mod build` refuses `eval`, `Function` and computed imports, and installs come from signed packages.

## Limits

Lucra times out a mod that's slow to answer, can turn any mod off everywhere, and checks every tree before drawing it. A broken mod shows an error in its own area; the rest of Lucra keeps working.