Security boundary

During the public beta, GitHub OAuth requests repo and user:email. The repo grant permits access to private repositories; select only a repository you are authorized to deploy.

This OAuth arrangement is a temporary public-beta boundary. It is not the source-access model promised for a broader multi-tenant release.

• Registry access is authorized through the GitHub OAuth flow with write:packages. Users do not copy or paste token material.
• RunYour.App does not request workflow or delete:packages for registry publishing.
• The registry connection has a one-year RunYour.App renewal horizon. GitHub, an organization administrator, or the user can revoke authorization sooner.
• Token material stays server-side, is encrypted at rest, and is never accepted from or returned to the browser.

Source, planning, build, readiness, and deployment run through dedicated worker and service-account boundaries. Build output is a private GHCR package and workloads are deployed by immutable digest.

Repository code is untrusted. Build and runtime use separate sandboxes with bounded CPU, memory, disk, process, and PID budgets. Runtime roots are read-only apart from explicit, size-limited ephemeral state.

Runtime environment values are encrypted, materialized only for the selected project, environment, revision, and component, and never returned after submission. Preview does not inherit production secrets. APIs and logs expose only masked metadata.

Only explicitly public, non-secret inputs can enter a build; build-time secret injection is not supported. Provider OAuth management credentials stay in the control plane and are never passed to repository build or application runtime.

Runtime outbound access is denied by default. Enabled Node profiles may resolve platform DNS and use public IPv4 HTTPS; private, cluster, link-local, metadata, and non-HTTPS destinations remain blocked.

Platform artifacts are stored in private object storage. Temporary workload credentials and versioned pull secrets are cleaned up by the deployment workflow.

Deleting a RunYour.App project removes platform-managed resources. Private GHCR packages remain in your GitHub account and must be deleted by you.

Send a minimal report to [email protected]. Include reproduction steps and safe identifiers, but do not include tokens, repository contents, or secret values.