# Security

> How sandboxes are isolated, how to handle credentials, sharing previews safely, abuse prevention, and reporting a vulnerability.

Flax Cloud runs untrusted code as a core function, so isolation and safe defaults are
fundamental to the product. This page explains how your sandboxes are isolated, what you're
responsible for, and how to share previews safely.

## How sandboxes are isolated

Each sandbox is a container launched with a hardened profile, on top of gVisor-hardened kernel
isolation (a user-space kernel that intercepts syscalls so sandboxes don't talk to the host
kernel directly):

- **Dropped Linux capabilities** - all capabilities are dropped, with only a minimal set added
  back, so code in a sandbox can't perform privileged host operations.
- **No privilege escalation** - `no-new-privileges` is set, so `setuid` binaries can't gain
  rights.
- **Resource caps** - per-sandbox **memory limit**, **CPU quota**, and a **process-count
  limit** prevent any one sandbox from exhausting the host.
- **Network isolation options** - run with `network_mode: "none"` for no network at all, or
  the default `bridge` for outbound access and previews.
- **Tenant isolation** - every API request resolves to your account; you can only see and act
  on your own sandboxes, commands, files, keys, and preview links.

## Credentials

- **API keys** (`flax_live_…`) are shown **once** and stored only as a SHA-256 hash. Treat
  them like passwords: keep them server-side, never commit them, and rotate (revoke + recreate)
  if one may have leaked.
- **Dashboard sessions** use an httpOnly cookie holding an opaque token (hash stored
  server-side); sessions are revocable and expire.
- **Browser CDP URLs** are short-lived and scoped to one sandbox owner. Treat them like temporary
  credentials because they allow direct browser control until expiry.
- Sending an invalid/expired credential returns `401`.

## Sharing previews safely

[Shareable preview links](./previews.md#shareable-preview-link-secret-url) are designed to be
safe to hand out:

- The URL contains a long random token that **is** the secret; links are unguessable and can't
  be enumerated (no listing endpoint).
- Only a hash of the token is stored.
- You can **disable** or **regenerate** a link at any time; disabling takes effect immediately.
- Access is logged, and stopped/destroyed sandboxes stop serving.

Still, anyone with the link can view whatever that port serves until you disable it - so only
expose ports you intend to share, and disable the link when you're done.

## Your responsibilities

- **Don't put secrets in places you then expose.** A previewed server serves whatever you run;
  don't bind sensitive admin endpoints to a shared port.
- **Treat sandbox output as untrusted** if you run third-party code or agents in it.
- **Use `network_mode: "none"`** when running fully untrusted code that shouldn't reach the
  network.

## Abuse prevention

Flax Cloud runs a free tier, so the platform enforces a few abuse controls. These exist to keep
the service available for everyone; they shouldn't affect normal use.

- **Egress hardening** - sandboxes have outbound internet for installing packages and calling
  APIs, but the host firewall blocks outbound SMTP (ports 25/465/587), the cloud metadata
  endpoint, and private network ranges. This stops spam relays and SSRF without affecting normal
  HTTP(S)/DNS traffic. For fully untrusted code, run with `network_mode: "none"`.
- **Disposable-email sign-ups are blocked** - accounts created with throwaway/temporary email
  providers are rejected.
- **Daily creation cap** - each plan caps how many sandboxes you can create per rolling 24 hours
  (separate from the concurrency limit), to prevent create/destroy abuse loops. Hitting it
  returns `402` with code `daily_sandbox_limit`.
- **Account suspension** - accounts found abusing the platform can be suspended, which blocks all
  API and dashboard access (`403` `account_suspended`) and reclaims any running sandboxes.

## All connections are encrypted

The platform is served over HTTPS, and preview subdomains get their own TLS certificates
automatically. Don't send credentials over anything but `https://`.

## Reporting a vulnerability

Found a security issue? Please report it privately to
[security@flaxcloud.com](mailto:security@flaxcloud.com) rather than opening a public issue.

## Launch caveats

For a plain-language list of what is currently enforced, what is still not launch-grade, and what
should be fixed before broader public or enterprise use, see
[Launch readiness and security caveats](./launch-readiness.md).