Skip to main content
sndbox treats the desktop host, browser sidecar, plugin runtime, remote runner, and control plane as distinct trust boundaries.

​
Local workflows

File pickers establish path approval. Network domains, browser profiles, background execution, commands, and communications are tied to the workflow revision. Secrets stay in the OS vault or protected store and are redacted from ordinary evidence. Python and JavaScript Code nodes in run mode cross the command-execution boundary and require revision-bound approval. Source-mode Code nodes do not execute their contents. Web Builder serves generated content only on 127.0.0.1; its browser-side JavaScript can still make requests using normal browser capabilities and CORS rules.

​
AI providers

AI API keys remain in the operating-system credential vault and are resolved by the Rust host. Workflow JSON contains a connection reference and model metadata, not the key. AI workflow building, AI nodes, and Code-editor generation send the request prompt and relevant graph or code context to the selected provider. OpenAI-compatible remote base URLs require HTTPS. Plain HTTP is allowed only for loopback hosts. A locally configured endpoint is a separate trust boundary and can forward data elsewhere, so its deployment and model policy remain the user’s responsibility.

​
Plugins

Signed immutable packages run as WebAssembly without general WASI. Host calls are typed and require declaration, node reference, user/workspace approval, and live policy. Package integrity and exact node version are pinned into the workflow.

​
Managed browsers

Each cloud execution receives a new Chromium process/context and temporary directory. Private/metadata network destinations are rejected, uploads use approved artifact roots, downloads are scanned, sensitive fields are masked, and the workload is destroyed after completion or failure.

​
Runners

Self-hosted runners create local Ed25519 device keys, sign fresh nonced requests, verify control-plane command signatures and content hashes, enforce environment/path/network policy locally, and use durable receipts to avoid redelivered completed command execution.

​
Cloud content

Sync uses AES-256-GCM and a key envelope but is service-readable. Raw credentials, cookies, profiles, local files, detailed logs, and screenshots do not sync by default. PostgreSQL row-level and permission checks scope workspace resources. Security-sensitive operations retain correlation and append-only audit evidence.