Security model · v0.1
Trust the boundary.
Question everything inside it.
opencloudbox isolates selected agent execution from your everyday computer, keeps bring-your-own-provider credentials local, and does not durably store plaintext workload secrets.
Compute boundaryThe selected sandbox provider
The trust model, end to end.
Adapters normalize provider APIs. They are not an unbypassable host sandbox. The selected provider supplies the remote-compute isolation.
Local agent · editor · BYOK provider credential
TLS + OAuth
Authorization · metadata · orchestration
Provider API
Session · workspace · processes · provider-native secrets
Inside the Session, treat code as untrusted. Repository code, dependencies, build scripts, install hooks, processes, agent output, and public network input can all be hostile.
Credentials do not all cross the same line.
BYOK provider credentialLocal device only
Read by the CLI to talk directly to the provider. It is not sent to opencloudbox or injected into the Session.
Managed-service credentialDeployment secret storage
Used by the hosted control plane for the managed provider relationship.
Workload secretProvider-native storage
Plaintext can transit opencloudbox memory once for relay, but has no durable opencloudbox storage.
GitHub App tokenShort-lived and scoped
Used only for the authorized repository operation, then allowed to expire.
Precise language matters
“No durable plaintext storage” is not the same as “zero knowledge.”
When a workload secret is relayed to a provider, plaintext may pass through process memory. And if a provider exposes a secret as an ordinary environment variable, permitted code in that Session can read it. opencloudbox labels that as the weaker mode.
What remains after the command ends.
The final public privacy notice will state dated retention periods before general service access.
Need implementation detail?
Open the docs