03 · Security
Security
What protects you depends on where each part runs. Here it is, plainly — including what is not there yet.
On the server (the remote engine)
An engine with no internet
The engine runs as a dedicated system user under systemd hardening. It has no internet access: it can reach loopback only.
Your key stays in the gateway
Your provider key lives only in a separate gateway process. The engine never holds it.
A gateway with an allowlist
The gateway lets through only the allowed model, routes and request fields.
Logs without your content
The logs carry fixed phrases only — no file content.
On your PC
The commands a task needs, such as tests and git, run on your own machine, in a separate worktree and branch. They are controlled by policy, not by operating-system isolation:
- Manual — you approve each program before it runs;
- Auto (with a local engine) — only a short read-only list runs without asking. With a remote engine, only Manual is available today; Auto with a remote engine is coming;
- a circuit breaker.
Not there yet
There is no operating-system sandbox on your PC today. A container mode is planned; it is not available.
Pairing
Your PC is paired with the server by a device key. The SSH tunnel account is restricted to port-forwarding to 127.0.0.1:7443 only.
Benchmark runs
Every benchmark task runs in a rootless Podman container: all capabilities dropped, no-new-privileges, seccomp, a read-only root filesystem, --pull=never and no logs. This is verified on every run.
Telemetry
None.
How we audit
Independent multi-agent code reviews, a separate review for every release, and a dedicated security agent before anything new is published. Found a problem? Write to contact@ozn.technology.