INFRASTRUCTURE & DISCLOSURE
Security Architecture
How APIRun ensures safe code execution, rigorous container sandboxing, and zero data leakage across local and cloud environments.
Security Contact: security@apirun.dev • Responsible Disclosure Policy
Ephemeral Sandboxes
Every code run and test execution is provisioned inside an ephemeral, non-root in-memory sandbox. Containers are destroyed immediately upon test completion.
Egress Restriction
Sandboxes operate under strict egress filtering. Outbound network requests to external public IP addresses are blocked at the socket level.
Strict Resource Limits
CPU limits (max 1 vCPU), strict memory caps (128MB), and execution timeouts (max 15s) prevent infinite loops and compute exhaustion.
Zero Local Target Telemetry
When verifying endpoints running on your localhost, test requests remain strictly client-side. Response payloads are never relayed to our servers.
01.Authentication & Session Security
Authentication is handled with asymmetric RS256 token signing, rotating refresh keys, rate-limited login endpoints, and brute-force protection. Passwords are never stored or logged in plain text.
02.Adversarial Test Suite Bounds
Our automated fuzzers simulate RFC boundary attacks (e.g., malformed payloads, timestamp manipulation, idempotency replays, and concurrent bursts). These tests are strictly calibrated to adhere to RFC-9110 HTTP specification compliance without kernel exploits.
03.Responsible Vulnerability Disclosure
We welcome reports from security researchers and developers. If you discover a potential vulnerability in APIRun infrastructure:
Disclosure Protocol:
- Email details directly to security@apirun.dev.
- Please include reproducible steps, target endpoints, and proof-of-concept payloads.
- Allow our engineering team 48 hours to assess the report before public disclosure.