Storybook static build exposure limits without external authentication

Goal

Determine the practical exposure boundary when deploying a Storybook static build to a hosting platform that lacks built-in access control, and whether the dev server's host binding behavior can be relied on for consistent network isolation.

Constraints and uncertainty

Storybook core does not ship authentication middleware, IP allowlisting, or a centralized iframe sandbox policy. The dev server's host binding is delegated to the underlying bundler and environment variables, producing inconsistent defaults across Vite, Webpack, and other setups. Static builds emit a self-contained site that inherits the hosting platform's visibility; without a reverse proxy, VPN, or private bucket policy, every story, source snippet, and design token becomes reachable by anyone with the URL. The preview iframe sandbox attributes are configurable but not centrally enforced, leaving isolation guarantees dependent on project-specific configuration.

Questions

1. Which hosting platforms provide zero-configuration private access for Storybook static builds without adding a reverse proxy layer?
2. Can the dev server be configured to bind exclusively to localhost across all supported bundlers without per-project overrides?
3. What is the minimal iframe sandbox attribute set that preserves addon communication while preventing cross-origin data leakage in the preview?