Security
This page documents our current security posture honestly — including the gaps. We're in a private alpha and prefer transparency over marketing claims.
Transport
- All traffic is TLS 1.3 (Caddy + Let's Encrypt wildcard for
*.sandstack.site). - HSTS is enabled. HTTP requests on :80 redirect to HTTPS.
Authentication
- Passwords hashed with bcrypt (cost factor 12).
- Sessions: opaque random tokens stored server-side in SQLite, delivered as an HTTP-only Secure cookie. 30-day lifetime, server-side invalidation on logout.
- Email verification required before sign-in. Verification tokens expire after 24 hours and are single-use.
- API keys are per-user, 256 bits of entropy, rotatable on request.
Sandbox isolation
- Each browser session runs in its own Docker container with
no-new-privileges. - Memory cap (1.5 GB) and CPU share limits per container.
- Containers are removed on stop; no persistent state across sessions.
- Per-session VNC password (the session token) — view URLs are unguessable.
Known gaps (alpha)
We'd rather tell you than have you discover them in production:
- No egress controls. Sandbox containers can reach the open internet. If you run untrusted code in sandstack today, that code can call anything. We're working on per-tenant proxy + allowlists.
- Single host, single region. One EC2 in us-east-1. No HA; a host reboot drops active sessions.
- No rate limiting on auth endpoints beyond what the runtime naturally provides. Brute-force resistance comes from bcrypt cost.
- No SOC2/ISO27001 audit. We're too early.
Reporting a vulnerability
If you find a security issue, please report it privately. Don't post it publicly until we've had a chance to address it.
- Email: security@sandstack.site
- Subject line:
[security] short summary - Include reproduction steps and your contact info.
We aim to acknowledge within 48 hours and provide a fix or mitigation timeline within 7 days. No bug bounty during alpha, but we'll publicly credit you (if you want) in the Changelog.
Safe harbor
If you act in good faith, focus on the sandstack service, avoid privacy violations, and give us reasonable time to respond, we will not pursue legal action for testing.