Visibility
Public, unlisted, and private scripts. Free accounts can host public scripts only.
Public
Anyone can GET /r/{slug} without a token. The share page /s/{slug} can show the source when the script is live and not held by a scan.
Unlisted
Raw fetch does not require a token. Anyone with the URL can download the bytes. The HTML share page hides the body unless the viewer has access. Unlisted is not access control. Pro and Teams only.
Private
Raw fetch requires a fetch token. A missing or wrong token still returns HTTP 200 with a stub program so curl -fsSL | runtime prints an error and exits 1. The original body is not included. The share page is 403 without access. Pro and Teams only.
Plans
Free accounts can create public scripts only. Switching a script to unlisted or private requires a paid plan.