> ## Documentation Index
> Fetch the complete documentation index at: https://docs.buntime.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Isolation, sandboxing, and security model

## Overview

buntime.sh provides secure, isolated execution environments for untrusted code. Each session runs in its own container with strict security boundaries.

## Isolation Model

### Container Isolation

Each session gets:

* Separate Linux container
* Isolated filesystem
* Isolated network namespace
* Resource limits enforced by kernel

### Network Access

Sessions can make outbound requests:

```typescript theme={null}
const response = await fetch('https://api.example.com');
```

But cannot:

* Accept inbound connections (except via preview URL)
* Access other sessions
* Scan internal networks

## What Code Can Do

✅ **Allowed**:

* Execute JavaScript/TypeScript
* Install npm packages
* Make HTTP/HTTPS requests
* Write files to /workspace
* Use databases (SQLite, etc.)
* Run web servers on port 8080

❌ **Not Allowed**:

* Access other sessions
* Mine cryptocurrency (CPU throttled)
* Port scanning
* DOS attacks (rate limited)
* Access host system

## Authentication

API requests require Bearer tokens:

```bash theme={null}
Authorization: Bearer your_api_key_here
```

### Best Practices

<AccordionGroup>
  <Accordion icon="key" title="Protect API keys">
    Never expose keys in client-side code:

    ```typescript theme={null}
    // ❌ Don't do this
    const client = new Buntime({ apiKey: 'btk_123...' });

    // ✅ Do this (server-side only)
    const client = new Buntime({ 
      apiKey: process.env.BUNTIME_API_KEY 
    });
    ```
  </Accordion>

  <Accordion icon="user" title="Isolate users">
    Create separate sessions per user/tenant:

    ```typescript theme={null}
    const session = await client.sessions.create({
      metadata: { userId: user.id }
    });
    ```
  </Accordion>

  <Accordion icon="code" title="Validate AI code">
    Review AI-generated code before execution:

    ```typescript theme={null}
    function validateCode(code: string) {
      const dangerous = [
        /require\(['"]child_process['"]\)/,
        /while\s*\(\s*true\s*\)/
      ];
      return !dangerous.some(p => p.test(code));
    }
    ```
  </Accordion>
</AccordionGroup>

## Data Security

### At Rest

* Files encrypted in R2 storage
* Metadata encrypted in KV
* Automatic deletion on expiry

### In Transit

* All API calls over HTTPS
* TLS 1.3 encryption
* No downgrade attacks

## Abuse Prevention

* CPU throttling for sustained high usage
* Memory limits enforced
* Execution timeouts
* Rate limiting per API key
* Automatic session cleanup

## Reporting Security Issues

Found a security vulnerability? Email [security@buntime.sh](mailto:security@buntime.sh)

<Warning>
  Do not open public issues for security vulnerabilities.
</Warning>