Security

Overview

buntime.sh provides secure, isolated execution environments for untrusted code. Each session runs in its own container with strict security boundaries.

Isolation Model

Container Isolation

Each session gets:

Separate Linux container
Isolated filesystem
Isolated network namespace
Resource limits enforced by kernel

Network Access

Sessions can make outbound requests:

const response = await fetch('https://api.example.com');

But cannot:

Accept inbound connections (except via preview URL)
Access other sessions
Scan internal networks

What Code Can Do

✅ Allowed:

Execute JavaScript/TypeScript
Install npm packages
Make HTTP/HTTPS requests
Write files to /workspace
Use databases (SQLite, etc.)
Run web servers on port 8080

❌ Not Allowed:

Access other sessions
Mine cryptocurrency (CPU throttled)
Port scanning
DOS attacks (rate limited)
Access host system

Authentication

API requests require Bearer tokens:

Authorization: Bearer your_api_key_here

Best Practices

Protect API keys

Never expose keys in client-side code:

// ❌ Don't do this
const client = new Buntime({ apiKey: 'btk_123...' });

// ✅ Do this (server-side only)
const client = new Buntime({ 
  apiKey: process.env.BUNTIME_API_KEY 
});

Isolate users

Create separate sessions per user/tenant:

const session = await client.sessions.create({
  metadata: { userId: user.id }
});

Validate AI code

Review AI-generated code before execution:

function validateCode(code: string) {
  const dangerous = [
    /require\(['"]child_process['"]\)/,
    /while\s*\(\s*true\s*\)/
  ];
  return !dangerous.some(p => p.test(code));
}

Data Security

At Rest

Files encrypted in R2 storage
Metadata encrypted in KV
Automatic deletion on expiry

In Transit

All API calls over HTTPS
TLS 1.3 encryption
No downgrade attacks

Abuse Prevention

CPU throttling for sustained high usage
Memory limits enforced
Execution timeouts
Rate limiting per API key
Automatic session cleanup

Reporting Security Issues

Found a security vulnerability? Email [email protected]

Do not open public issues for security vulnerabilities.

Resource Limits

Getting Started

Guides

Concepts

Overview

Isolation Model

Container Isolation

Network Access

What Code Can Do

Authentication

Best Practices

Data Security

At Rest

In Transit

Abuse Prevention

Reporting Security Issues

​Overview

​Isolation Model

​Container Isolation

​Network Access

​What Code Can Do

​Authentication

​Best Practices

​Data Security

​At Rest

​In Transit

​Abuse Prevention

​Reporting Security Issues

Overview

Isolation Model

Container Isolation

Network Access

What Code Can Do

Authentication

Best Practices

Data Security

At Rest

In Transit

Abuse Prevention

Reporting Security Issues