Assume repository content is hostile
Source code, configuration, comments, screenshots, logs, model output, and browser content are all untrusted. Security comes from capability separation, not prompt instructions or secret filtering.
Trust boundary
Untrusted
Repository and browser input
Code, metadata, pages, logs, screenshots, and model output may be hostile.
Isolated
Bounded execution
Attempt-scoped runners receive narrow capabilities and no publisher credential.
Trusted
Control plane validation
Structured results, scope, policy, and artifact classification are verified.
Trusted
Publisher
Only classified summaries and statuses cross into provider systems.
Default boundaries
- Agent and browser sandboxes receive no GitLab, Slack, Linear, publisher, or SaaS database credentials
- The CI bridge receives a short-lived, stage-specific GitLab OIDC token, not a reusable secret
- Human GitLab OAuth grants and refresh tokens are not retained after sign-in
- Repository access is supplied separately by an encrypted organization service-account token
- Raw reports and artifacts remain dashboard-only by default
- Only the trusted publisher can write provider statuses or comments
- Agentic QA uses synthetic data and attempt-local dependencies; public execution additionally requires externally enforced egress denial
- Repository-controlled limits may only reduce platform budgets
Publishing findings
The dashboard preserves private evidence. Posting an MR summary is an explicit repository setting. Before publication, structured findings are validated against changed hunks and classified for the destination. Obfuscation filters are defense in depth, not the secret boundary.
Execution status
Dogfood only
Shared Docker executor
Used to iterate on first-party repositories. It is not an acceptable public multi-tenant boundary.
Public release requirement
Ephemeral VM or microVM
Customer execution requires externally enforced isolation, egress policy, resource ceilings, and destructive teardown.
Report a vulnerability
Do not include secrets or exploit details in a public issue. Contact the Code Voucher team through your private support channel and include the affected run ID.