Security
Full description: Read the full narrative
Report vulnerabilities by email to the address in SECURITY.md (48-hour response target). The current threat model — SSRF guard, auth surface, key handling, JWT strength enforcement, brute-force lockout, public-endpoint limiting, CORS allowlist, injection defences — is maintained there.
Security-relevant implementation points
| Control | Verified detail | Source |
|---|---|---|
| Secrets in repo | runtime .env is gitignored; Kaggle credentials read only from ~/.kaggle | docs/site/markdown/DEPLOYMENT.md:173 .gitignore:.env |
| JWT strength | prod boot refuses JWT_SECRET < 32 chars | server/index.ts:171-181 |
| Sandbox | execution caps + audit log per exec | server/index.ts:8655-8658,8718 |
| Sim kernels | receive JSON params only; no shell interpolation of user values | server/kaggle/simRunner.ts:156-175 |
| Auth surface | public allow-list explicit; everything else behind authGuard | server/index.ts:373-487 |