Security
How pyrovue contains code nobody has read.
Running other people's code is the whole product, so the box is built to assume it's hostile. This page says what pyrovue does to your box, your account and your data, and what isn't done yet. Found a problem? Write to hello@pyrovue.com.
Isolation
Every box is a fenced-off container.
One repository, one box. The container settings below apply to every box; the runtime underneath decides how much of the host kernel the box can reach.
- runcdefault
The standard container runtime. The box shares the host's kernel, fenced off by the container controls.
- gVisorBOX_RUNTIME=runsc
A user-space kernel answers the box's system calls, so the host kernel never sees them. Tested with the full e2e suite; installs take about twice as long.
- Firecracker microVMBOX_RUNTIME=kata-fc
Kata Containers on Firecracker: each box gets its own kernel behind hardware virtualization. Needs KVM on the host.
CPU, memory and process limits, no swap, no-new-privileges, five capabilities dropped, an init process, its own bridge network.
- Resource limits2 vCPU · 4 GB · 2,048 processes by default
- Every box has a CPU quota, a memory limit with no swap on top, and a cap on processes, so a fork bomb or a leaking dev server hits its own ceiling, not the host's. On hosted plans the size follows the plan, up to 16 vCPU on Enterprise.
- Privilegesno-new-privileges · 5 capabilities dropped
- Processes can't gain privileges through setuid binaries.
NET_RAW,MKNOD,AUDIT_WRITE,SYS_CHROOTandSETFCAPare dropped, so a box can't craft raw packets or make device nodes. An init process reaps zombies, and a box that crashes stays down instead of restarting. - No Docker insidethe socket is never mounted
- Boxes don't get the Docker socket or any host directory. The only thing mounted is an optional CA bundle, read-only.
- Runtimerunc today
- Boxes run on the standard container runtime, which shares the host kernel like any container. Moving boxes to gVisor, a user-space kernel, is on the list below.
Network
Out to the internet, not into your network.
A box can install packages from anywhere, but it shouldn't reach the machines around it, the cloud it runs in, or the app that launched it.
- Outboundscripts/harden-network.sh
- Boxes need the internet to install packages, but not your network. The hardening script rejects traffic from the box subnet to link-local addresses (including the cloud metadata endpoint at
169.254.169.254), the private ranges10.0.0.0/8,172.16.0.0/12and192.168.0.0/16, and carrier-grade NAT (100.64.0.0/10, where tailnets live). - Between boxesenable_icc=false
- Boxes sit on their own bridge network. When the server reaches boxes through published ports, traffic between containers on that network is turned off.
- Previews<slug>.pyrovue.app
- Each box is served on its own subdomain through pyrovue's proxy, and the box's relay port is published on
127.0.0.1only. Previews are served from pyrovue.app, a different site from pyrovue.com, so preview pages can never read the app's cookies. - The app itselfCSP · HSTS · frame-ancestors 'none'
- Pages carry a Content Security Policy that only runs pyrovue's own scripts and can't be framed. Responses send HSTS over https,
X-Content-Type-Options: nosniff, a strict referrer policy, a permissions policy that turns off camera, microphone, location, payment and USB, a same-origin opener policy and a same-site resource policy. Requests that change state must come from the app's own origin.
Accounts
Your account, locked down.
Sessions you can see and end, and a record of what happened, all in Settings.
- Passwordsscrypt · at least 10 characters
- Passwords are hashed with scrypt and a random salt. New passwords need ten characters and are checked against a list of commonly guessed passwords, including letter-swapped versions, instead of composition rules.
- Sessions30 days · HttpOnly · SameSite=Lax
- Session tokens are 32 random bytes, kept on the server only as a SHA-256 hash. Over https the cookie is
Securewith the__Host-prefix. Settings lists every signed-in device with its IP and last use, and you can sign out any one of them, or all the others at once. - Signing inpassword · GitHub · Google
- Signing in with GitHub asks only for your profile and email address, not for access to your repositories. Signing in with Google asks only for your name, email address and picture. Optional sign-in codes by email: a 6-digit code after the password, good for 10 minutes, 5 tries, 3 codes per sign-in.
- Rate limitsper IP and per account
- Sign-in attempts are limited per IP (40 per 15 minutes) and per account (8 per 15 minutes), and sign-ups per IP, with a daily cap.
- Audit logkept per account
- Sign-ins and failed attempts, sign-outs, password changes, revoked sessions, boxes created and deleted, visibility and plan changes, and boxes stopped for abuse are recorded with the time, IP and device.
Your data
What's kept, what's shared, and for how long.
Boxes are temporary by design. What outlives them is small: the tour, the Code Map, the setup log and, for the repository, a recipe.
- What runspublic repositories, and your own private ones
- pyrovue clones public repositories from github.com and gitlab.com at depth 1 into the box. A private GitHub repository is cloned with your own GitHub access, passed to the clone command alone; its box is always private and its setup is never shared.
- How long boxes live15 minutes to 4 hours idle
- A box with no viewer goes to sleep, then is deleted after 24 hours on Hobby, 7 days on Pro and Team, or 90 days on Enterprise. Its tour, Code Map and setup log are kept until you delete the box. Deleting a box removes all of that at once; what it used this month still counts.
- Shared linkscredentials masked for viewers
- Anyone with a public box's link can watch it. Before its setup log and notes reach anyone but the owner, pyrovue masks things that look like credentials: API keys and tokens (Anthropic, OpenAI, GitHub, AWS, Stripe, Slack, Google, npm, Hugging Face and more), private keys, passwords in URLs, bearer tokens and
PASSWORD=-style settings. On Pro and Team, a box can be private: its share link stops working, and the running app is only at an unguessable address. Services the app itself calls can still see that address. - Recipessaved per repository
- When a setup works, its commands and start settings are saved for that repository, so the next person to run it gets them replayed. Recipes belong to the repository, not to your account.
- Claudeonly when Claude does the setup
- When the Claude agent sets a repo up, the repo's file list, key files and command output are sent to Anthropic's API. Detector setups and recipe replays send no repo content to any model provider.
- Payments and deletionStripe Checkout
- Card details go to Stripe's checkout and never reach pyrovue's servers. Deleting your account stops and removes all your boxes and deletes the account record; you'll be asked to cancel a paid plan first.
Abuse
Free compute attracts miners. Boxes are watched.
Quotas keep any one account from taking over a host, and a watchdog looks inside running boxes for the usual abuse.
- Mining watchdogevery 2 minutes
- pyrovue looks inside each running box for cryptocurrency miners: known miner programs, mining commands and algorithms, and connections to mining-pool ports on public addresses. A strong signal stops the box at once; weaker ones stop it when they repeat or add up. Every stop goes in the owner's audit log.
- Disk20 GB per box by default
- Every 10 minutes, or every minute when the host runs low on space, the watchdog measures each box's workspace. A box over the limit is stopped and its container deleted, which gives the space back; waking it sets it up again. New boxes are refused when the host has less than 2 GB free, and a box's saved log stops growing at 4 MB (it keeps streaming live).
- Quotasboxes at once · box-hours · setup time
- Each plan caps boxes running at once, box-hours a month (boxes stop at the quota) and how long one setup may run (20 to 60 minutes). Each instance also limits how many setups run at the same time. Suspended accounts can't start boxes.
Responsible disclosure
Found a hole? Tell us first.
Email hello@pyrovue.com with what you found and how to reproduce it. Give us a reasonable chance to fix it before you publish, and don't access other people's data or degrade the service while you test. Boxes are meant to run untrusted code: getting out of a box, into another box, or into the host is in scope; running code inside your own box isn't a finding. We'll credit you if you'd like; there's no paid bug bounty yet.
Not done yet
What we haven't done, plainly.
Better you read it here than find it in a security review.
No SOC 2 report yet
pyrovue hasn't had a third-party audit or penetration test. If you need one for procurement, talk to us before you buy.
SAML single sign-on
Coming for Enterprise. Today there's email and password, with optional GitHub or Google sign-in.
GitHub access isn't per repository
Connecting GitHub for My Repos grants access to every repository you can reach, as GitHub's OAuth does. A GitHub App limited to the repositories you choose is planned.
Default runtime shares the kernel
Boxes run on runc for speed and compatibility. gVisor is tested and planned for pyrovue.com.
Disk isn't capped as it's written
Container writes aren't limited by Docker by default; the watchdog stops boxes over the limit after the fact.
Network rules are applied by a script
The rules that keep boxes out of private networks are applied by a script on the host at boot, not by the container runtime itself.