Custom CSS

Use the public theme contract, maintain compatibility, and recover a broken interface.

Open Settings → Developer → Custom CSS. This feature is strictly for appearance: it does not add server capabilities and does not change permissions.

Recommended contract

Use the public variables --nd-*. Internal classes .nd-* may change and do not constitute a stable contract.

:root {
  --nd-accent: #7c3aed;
  --nd-accent-glow: rgba(124, 58, 237, 0.18);
  --nd-card-radius: 16px;
  --nd-card-border: rgba(124, 58, 237, 0.24);
}

Colors and surfaces

Variables	Usage
`--nd-bg`, `--nd-bg-surface`, `--nd-bg-gradient`	Global background
`--nd-card-bg-rgb`, `--nd-card-bg-opacity`, `--nd-card-bg`	Card surfaces
`--nd-subcard-bg`, `--nd-card-border`, `--nd-card-hover-border`, `--nd-card-shadow`	Nested cards, borders, and shadows
`--nd-text`, `--nd-text-muted`, `--nd-text-dimmed`	Typographic hierarchy
`--nd-accent`, `--nd-accent-glow`, `--nd-accent-dim`	Accent color
`--nd-green`, `--nd-yellow`, `--nd-orange`, `--nd-red`	States
`--nd-blue`, `--nd-purple`	Complementary colors
`--nd-progress-bg`, `--nd-progress-fill`	Progress indicators
`--nd-icon-bg`, `--nd-icon-border`	Icon containers

Shapes and motion

--nd-card-radius controls corner radii, --nd-blur controls background blur, and --nd-transition controls the standard duration.

Mobile and accessibility

:root {
  --nd-card-radius: 18px;
}

@media (max-width: 700px) {
  :root {
    --nd-card-radius: 10px;
    --nd-blur: 8px;
  }
}

@media (prefers-reduced-motion: reduce) {
  :root {
    --nd-transition: 0ms;
  }
}

Maintain sufficient contrast, visible focus indicators, and comfortable touch target sizes. Test in light mode, dark mode, mobile, tablet, and desktop.

Safe recovery

If the CSS hides the navigation, open:

https://votre-nasdash.example/?safe-css=1

The parameter disables the saved CSS for this load without deleting it. Open the settings, fix or reset the CSS, then reload the normal URL.

Security limits

Maximum size: 256 KiB;
Scripts, dangerous protocols, HTML/style breakouts, expression(), historical behaviors, and remote @import are neutralized;
CSS comments are removed;
An ordinary external url(...) can contact a third-party server and reveal the visitor's IP address.

Sanitization is a complementary protection, not a reason to grant administration privileges to an untrusted person.