If you find a vulnerability in Invincible, please open a private security advisory on GitHub (or email the maintainer) rather than a public issue with exploit details.

Session blobs and Wasm must never contain API keys or sandbox tokens.
Never use NEXT_PUBLIC_SANDBOX_* (or any client-exposed sandbox secret).

Product behavior: docs/session-model.md.

When BUILTIN_HTTP_FETCH=sandbox, agent tools may fetch public HTTPS URLs via a durable HTTP/curl Vercel Sandbox instance (hop B) — attach-only to a name the user created under Settings → Sandbox. App-side SSRF policy runs first (https-only; no private/metadata hosts; redirects only after re-check of each Location). Never put Gateway, BYO sandbox, or MCP secrets into the Sandbox child env. No NEXT_PUBLIC_* for this feature. Instance names and control-plane credentials never enter client/Wasm. See docs/builtin-http.md.

Residual (v1): Policy is preflight-only on the app (literal + DNS at check time). Hop B re-resolves the hostname under Sandbox networkPolicy: allow-all. A short-TTL / DNS-rebinding name could flip to a private or link-local address between preflight and curl. Redirects are followed hop-by-hop with the same policy on each Location (curl still --max-redirs 0 so the microVM never blind-follows). Accept residual DNS rebinding for v1; harden later (IP pin / egress deny) if product needs stronger guarantees.

Zig builds run on a self-hosted GitHub Actions runner (default labels: self-hosted, invincible, zig).

To reduce abuse risk when this repository is public:

1. Default triggers on self-hosted workflows: push to main (path-filtered) and workflow_dispatch.
2. build-harness only also runs on pull_request → main when all of:
   • head branch is in this repository (head.repo.full_name == github.repository) — not forks;
   • author_association is one of OWNER / MEMBER / COLLABORATOR / CONTRIBUTOR;
   • path filter matches harness sources / this workflow.
   • Never pull_request_target. Never Vercel deploy hook on PR. Other self-hosted workflows stay main/workflow_dispatch only.
3. Jobs include if: guards:
   • Opt-in: vars.SELF_HOSTED_BUILDS == 'true' (repository Actions variable, not a secret), or
   • Origin grandfather: github.repository == 'btipling/invincible' (maintainer continuity if the variable is unset)
   • and event is workflow_dispatch, push to main, or the same-repo contributor pull_request rules above (build-harness).
4. Clones / forks must set SELF_HOSTED_BUILDS=true after attaching their own runner. Without that variable, self-hosted jobs skip (safe default).
5. Optional: vars.RUNNER_LABELS as a JSON array (e.g. ["self-hosted","invincible","zig"]). If unset, workflows use that default list via fromJSON.
6. Do not add fork PR or pull_request_target builds on self-hosted without a deliberate design review. Expanding PR CI beyond same-repo contributor heads is a security change.
7. Prefer GitHub setting: require approval for first-time contributors’ workflows; keep fork PR workflows off the self-hosted pool.
8. Host inventory (IPs, droplet IDs) is not published in this repo — keep private notes offline.

Maintainers: still harden the VM (SSH keys, firewall, unattended upgrades) using private runbooks; public docs stay abstract.

The agent sandbox is an optional remote workspace for model tools (list_dir / read_file / write_file / exec). It is not the self-hosted GHA runner that compiles Zig.

Each sandbox row may use backend=byo (URL + DEK-encrypted token) or backend=vercel (host Vercel project OIDC; optional image ref). Users Create durable Workspace/HTTP instances in Settings; the agent only attaches (never Sandbox.create / getOrCreate on a turn). Destroy removes the platform VM and the DB row. There is no product host env SANDBOX_BACKEND. Registry credentials for custom images stay on the host Vercel/CI side — never in the DB. Token rotate applies to byo only. Per-user instance names are server-generated and never exposed as client secrets.

Dogfood image push (GHA dev-image-build): builds a toolchain OCI image from dev/Dockerfile and pushes to Vercel Container Registry. Uses Actions VERCEL_TOKEN + team/prefix identifiers only. Never bake AI_GATEWAY_API_KEY, DATABASE_URL, sandbox tokens, or AMK/DEK material into image layers. The dogfood image is not the self-hosted Zig build-harness runner.

Inference is server-side only (POST /api/chat, POST /api/agent). Report client-side key or sandbox-token exposure immediately.

Agent SSE: when Accept: text/event-stream, event string fields (text, summary, error, tool names, etc.) are redacted with the same secret list as JSON responses before they hit the wire. Never put Gateway keys, sandbox tokens, provider/MCP secrets, or raw DEK material in stream payloads. See docs/agent-stream.md.

Sandbox inventory / tool surface (GET /api/sandboxes): non-secret, auth-gated (middleware + in-route requireSessionUser; 401 unauth). Returns the user's allowed sandboxes { id, name, slug, backend, status, image, canRead, canWrite, usable, granted } and, when ?sandboxId= (the session-owned active id, Redis-safe) is supplied, an active bind with its permission-aware tool-surface descriptor (lib/tenancy/sandboxTools.ts). Always omits base_url / token_ciphertext / host inventory. A provided-but-unusable active id is 403 (mirrors resolve) — never a stubbed active; a present-but-non-Redis-safe ?sandboxId= is 400 (matches parseAgentBody, not silently active: null). The session binding itself is server-authoritative: switching routes tools via resolveAgentSandbox's init.requestedSandboxId, never via a client-chosen secret.

Agent personas (GET /api/personas + server injection): persona bodies are non-secret user content (plaintext in user_personas, no DEK). Operator rule: never store API keys, tokens, or credentials inside a persona — put them in the real secrets surface (per-user MCP, GitHub PAT, sandbox env). The picker only receives summaries (id/name/slug/isDefault/updatedAt); the body is resolved server-side by id and injected as a system-preamble snapshot (meta.personaSnapshot, ≤ 512 KiB). Nothing secret is added to the client bundle or the harness Wasm. See docs/personas.md.

Unauthenticated API returns 401 with JSON { "error": "Authentication required." } (stable error constant AUTH_REQUIRED_ERROR). Sandbox grant failures return 403 { "error": "Sandbox access denied." } (SANDBOX_FORBIDDEN_ERROR). Multiple usable sandboxes without a Settings preference → 403 selection-required message. Inference grant / model failures return 403 / 400 (INFERENCE_FORBIDDEN_ERROR / INFERENCE_MODEL_REQUIRED_ERROR); temporary resolve/catalog failures return 503 (INFERENCE_UNAVAILABLE_ERROR).

Cutover: docs/bring-your-own.md §4a.
OIDC / SCIM operator notes: docs/bring-your-own.md §4b.