The webcore editor edits a piston. The piston is stored in the webcore child app (that is the piston) which is seen under the HE console apps -> webcore -> child piston. (this also means when you take HE hub backups, you have backups of all your pistons.)
You can backup pistons to local files, but the browser editor is interacting with the HE hub.
It needs to to be able to run / debug / trace / stat the piston, as well as show you what devices, etc are available. The browser app is a IDE vs. just an editor.
The browser (or any browser) cannot get access until you grant it (this is the browser registration code). The browser / hub communication is thru the standard HE cloud endpoints (these exist whether using webcore or not), so webcore does not open up network ports or the hub in some 'different' way than it is already setup.
You can run the webserver for the IDE html/css files locally (ie no internet). This has the side effect that you can only edit pistons when you are on your home network, or have a VPN that both your browser, your html/css web server, and the HE hub are all accessible.
This is described in note 2 of the webcore updates thread. It is likely a good idea to read note 1 and 2 of this thread to understand how things work.
Current data for small piston execution on my hubs is 5 ms at this point.
