Security

How the platform keeps one user's work away from another's, what happens to a machine when you stop it, and how to report a problem. The full mechanics are in Isolation and secrets.

One dedicated machine per runtime

Every runtime is its own single-tenant virtual machine, provisioned fresh for the session and destroyed when it ends. The instance and its boot volume are never reused for another session or user; the hypervisor is the isolation boundary. Your kernel, terminal and SSH sessions run as an unprivileged user on that machine.

No inbound ports

A runtime accepts no inbound connection on the data path. The kernel, the terminal and SSH bind to localhost, and the machine opens one outbound encrypted tunnel to the platform's session gateway; browsers and SSH clients reach the machine only through that tunnel. A runtime cannot reach other runtimes, the platform's database or cache, or control-plane internals; its internet egress follows the Environment's egress policy.

Least privilege on the machine

A runtime carries no standing cloud credential. The credential that mounts your workspace is short-lived, scoped to that one workspace, and fetched at mount time. Each session's API key has a scope strictly narrower than a personal key and is revoked within a minute of the session stopping.

Data at rest

Workspace storage, the platform database and the secrets store are encrypted with platform-managed keys. Workspace Secrets are write-only: a value is never returned by any API, appears in no log or database column, and reaches a runtime only as a file on its ephemeral disk that is destroyed with the machine.

Sharing

Access is enforced by the API on every request. Share grants give a named person read and copy access to one object without a storage credential ever being issued; public links are unguessable, revocable and rate-limited; shared environments are redacted for anyone but the owner. Before anything is shared, a credential scanner checks the content and asks for confirmation when it finds something that looks like a key.

Reporting a vulnerability

We welcome reports from security researchers. [TODO: security contact email, PGP key if any, scope, safe-harbour statement, expected response time.]

Compliance

[TODO: certifications, audits, or "none yet", and a data-processing agreement contact.]