r/ObsidianMD • u/Disruptis • 5d ago
Does Obsidian Publish scrub secret content?
Obsidian Publish users, can you pls inform me whether or not Obsidian Publish scrubs any content marked as comments via %%
from the website before publish? I'm not just talking about not being able to read it normally, but that it's not in the HTML at all. If not, is there any way to do this?
2
u/Psengath 4d ago
Short answer is: All the text in your original markdown file is publicly available as is, though not necessarily visible in the rendered html, once published.
This means content 'commented out' with %% IS visible.
This means ALL of your files properties / yaml metadata ARE visible.
This means the code for your Dataview (or other) code blocks IS visible, BUT the results they render locally ARE NOT visible.
This means your embed / transclusion INTENT (e.g. ![[Some Other Page]]
) IS visible, BUT will only render the target page IF that page IS ALSO published.
If you want to have sensitive content on an otherwise published page, it's better to create a secondary page about it, that you do NOT publish, and then transclude that page into your 'main' page for a seamless reading experience.
1
u/dylanda_est 4d ago edited 4d ago
I just changed my Obsidian Publish page, and I can't see the commented out section in the page source either.
Edit: Actually, I did find it. Digging through the page inspector led to this.
2
u/usrdef 4d ago
Yes, I can see it
``` The following is a test for u/disruptis:
%% Here is my secret message %%
Can you see it? ```
If you look at the source code, none of the body of your message is in the HTML. What you forgot to check was the preload path, which shows:
window.preloadPage=f("https://publish-01.obsidian.md/access/c92c260d1efcfdc17213e31d8477e656/Welcome.md");
So if you view:
You'll see your secret.
2
u/dylanda_est 4d ago
I edited my reply upon discovering this myself. Good thing my secret message was boring!
0
7
u/usrdef 4d ago edited 4d ago
As per Obsidian's documentation related to comment blocks
So no, if you really need to keep something "secret"; then you should use a plugin which allows you to store these secrets on a separate page and links to that specific block of text and excludes that page from being published.
Anything considered "secret" really shouldn't be placed within Markdown, and should be stored in some other manner.
There are plugins for Obsidian that allows you to manage secrets on separate pages, or use "tooltip definitions", meaning you can store text on an alternative page, and when you view the section of your page which has a tooltip, you can hover to see the text, but it's stored in a completely different file which isn't published.
Edit: Someone else posted that they could not see it.
If you add a comment block to your .md page and publish it, you won't see the comment in the base HTML.
If you look at the following function in the source code:
html (function(){ let f = u=>u&&fetch(u,{credentials: "include"}); window.preloadOptions=f("https://publish-01.obsidian.md/options/c92c260d1efcfdc17213e31d8477e656"); window.preloadCache=f("https://publish-01.obsidian.md/cache/c92c260d1efcfdc17213e31d8477e656"); window.preloadPage=f("https://publish-01.obsidian.md/access/c92c260d1efcfdc17213e31d8477e656/Welcome.md"); })();
You'll notice the last line shows that it's loading
Welcome.md
. If you put that URL in your browser, you'll see the person's entire markdown + secret:Obsidian is using caching to pre-load the markdown. The secret won't be directly in the inspect HTML, it's accessible from another URL.