Borealis Docs

Security, variables, and trust

A sandbox is one part of a secure workflow. The code, credentials, host operators, and services you expose also matter.

Understand the boundary

The documented production sandbox flow uses container-based execution. Do not treat it as a promise of a separate virtual machine for every workload.

Use trusted images and keep them updated. For client-managed capacity, the host operator is part of your trust boundary and is responsible for the underlying machine. Do not give an untrusted party administrative access to hosts that run sensitive workloads.

Protect credentials

Ordinary sandbox environment values and template variables are configuration, not a write-only secret store. They can become container environment metadata. Avoid storing long-lived credentials there.

The exec contract has sensitive-input and redaction facilities for supported runtimes. Inspect sandbox capabilities before relying on them. Redaction reduces accidental disclosure in supported output paths; it cannot prevent the program receiving a secret from deliberately sending it elsewhere.

Use narrowly scoped, short-lived credentials where possible. Rotate or revoke a credential if it has been exposed.

Limit exposed services

Only register the ports your workload needs. Apply application-level authentication where appropriate and do not assume a preview URL inherits API access controls.

Be especially careful with debugging interfaces, package dashboards, and administrative endpoints. Review ports and previews before sharing an address.

Treat archives as sensitive

Snapshots and workspace exports can preserve credentials or private source files written by your tools. Check their content and access controls, and define a retention policy appropriate to your organisation.

Report a vulnerability

Follow the vulnerability disclosure policy for security reports and the site’s security information for published policy. Remove credentials and unrelated personal data from evidence before sharing it.