SECURITY
Two threat models sit on top of each other here: an untrusted page being rendered inside our infrastructure, and an untrusted caller — human or agent — trying to reach content, money or other tenants. Both are enforced in the same request path, and neither depends on a caller behaving well.
single-use sandboxesno long-lived API keyssigned content deliveryhash-chained audit logsafe-harbour disclosure
Every render runs in a single-use sandboxed container with a fresh profile. Nothing survives the response: no cookies, no cache, no disk, no shared memory between tenants.
kernel-level syscall filter · no reuse across callersThe browser’s egress path resolves DNS itself and refuses RFC1918, link-local, loopback, IPv6-mapped and cloud metadata ranges — including after a redirect or a DNS rebind mid-render.
deny 169.254.0.0/16 · 10/8 · 127/8 · re-checked per hop/v1/eval runs in page context with no Node bridge, no file system, no fetch to internal hosts and a hard CPU and wall-clock budget. A script that tries to spawn or read outside the tab fails closed.
no CDP passthrough · 30s wall · 2 vCPU capPer-render memory, CPU, socket and download ceilings, plus a bomb detector for zip, SVG and font payloads. Exceeding any ceiling kills the container and returns 504 unpaid.
512MB · 200 sockets · 25MB body capExtracted text and HTML are returned as inert payloads with content-type pinned and prompt-injection markers preserved but escaped, so a downstream agent sees page text as quoted evidence rather than commands.
text/plain · injection markers flagged in metaCaches are keyed per caller and per URL, so one tenant can never seed a response another tenant will read. Sessions are pinned to the wallet that opened them.
cache key = sha256(caller, url, params)A payment nonce is bound to one request hash and one wallet, expires in 120 seconds, and is burned on first settlement. Replaying it returns 409 and settles nothing.
nonce ⇒ (wallet, body_hash, exp) · burn on useThe quoted price is signed over a hash of the exact request body. Change one parameter after the quote and the signature no longer matches the work requested.
sig over sha256(body) · mismatch ⇒ 402 re-quoteWork starts only after the authorization verifies. There is no optimistic path, no trial credit and no header that grants a free render.
verify → render → settle · no bypass flag existsPer-request, per-agent, per-day and per-environment ceilings are enforced server-side against the wallet, not just in the SDK. A compromised agent hits the cap and stops.
429 spend_cap_exceeded · caps set per environmentThere is no API key to leak or rotate. A leaked signature buys exactly one already-quoted render, for at most 120 seconds.
no bearer tokens on /v1/*Each response carries a receipt id and transaction reference. Spend can be attributed per agent, per endpoint and per environment without trusting client-side logs.
GET /v1/receipts/:id · immutableSAML or OIDC with enforced MFA, WebAuthn allowed as the only factor for publishers, short sessions and re-authentication before any destructive action.
session 8h · step-up re-auth on publish & role changeRoles grant verbs, not screens. A translator locked to one locale cannot touch the source or promote anything, even by calling the API directly.
server-side policy check per field writePublishing to production requires an approval from a different identity than the author, and release managers cannot author the content they promote.
author ≠ approver · enforced at promoteThe AI assistant and every automation run as service identities that can draft and propose, never approve or publish. An AI suggestion is a diff awaiting a human.
scope: content.draft · publish deniedDelivery tokens are read-only, environment-scoped and expiring; management tokens are short-lived, IP-bound and never valid for production content.
read tokens ≤90d · mgmt tokens ≤1h, IP-pinnedEvery login, field change, role change, token mint, promote and purge is logged with actor, IP, before and after values, hash-chained so a deleted entry is visible as a gap.
hash-chained · streamed to your SIEMPublished entries are signed at promote time. The delivery layer refuses a payload whose signature does not match, so a compromised cache or origin cannot inject copy.
ed25519 per entry · verified at edgeAuthor input is parsed to a block AST and re-serialized. Inline event handlers, script and iframe nodes, javascript: URLs and unsafe SVG are dropped, not escaped and hoped over.
allowlist AST · uploads re-encodedEvery upload is content-sniffed, size-bounded, stripped of metadata and re-encoded. SVGs are parsed and rewritten with scripts and external references removed.
no svg script/xlink · isolated asset hostUnpublished content is reachable only through a signed, expiring preview token bound to one entry, one environment and one identity, and never indexed.
15m tokens · noindex · no public draft pathPreview and sandbox environments are seeded with synthetic content. Copying production entries into a lower environment requires an explicit, logged approval.
one-way promote by defaultOutbound webhooks are signed with a rotating secret and a timestamp; inbound calls must present a valid signature within a five-minute window or are dropped and logged.
HMAC-SHA256 · 5m replay windowPer-wallet concurrency and burst limits sit in front of the render fleet, with adaptive backoff for callers whose failure ratio spikes — a scraper loop degrades itself, not the fleet.
adaptive concurrency · 429 with retry-afterBlocklists cover known credential-stuffing targets, banking auth flows, CSAM hash sets and customer-requested opt-outs. Refusals are logged and never charged.
451 blocked_target · opt-out via robots + registryDetection watches for credential-shaped payloads, high-entropy URL fanout, sudden region hopping and repeated 402 probing, and quarantines the wallet pending review.
auto-quarantine · human reviewConnector credentials and wallet policy live in an HSM-backed store, encrypted per tenant, decrypted only in the process that uses them, rotated on a schedule and on any role change.
AES-256 at rest · TLS 1.3 in transit · 90d rotationChromium builds, base images and SDK releases are reproducible, signed and SBOM-published. Deploys require a signed provenance attestation to run.
sigstore provenance · deploy gateKill switch per endpoint, per region and per wallet; 90-day hot audit retention; restore drills and a published incident timeline.
revocation propagates in secondsABUSE MODEL
HONEST LIMITS
No vendor can promise an unbypassable system, and a page that says otherwise is selling you something. What we can promise is that every control above is enforced server-side, in the request path, with no client-supplied flag able to switch it off — and that we publish where the edges are.
A target site can serve you anything. We isolate it and label it; judging its content is your agent’s job.
We mark and escape injection patterns and keep page text out of the privileged path. A model that chooses to obey quoted text is still a risk you own.
We enforce the caps you set. Set none, and a compromised agent can spend up to your balance.
We are not currently SOC 2 or ISO 27001 certified, and we will not claim it before an auditor signs it off. Ask us for the current control documentation and we will send what we actually have.
security@MY_DOMAINNAME · PGP 0x9F2C 81A4
First response within one business day. Safe-harbour for good-faith research, bounty paid in USDC, no NDA required to report. Our machine-readable policy lives at /.well-known/security.txt.