Built to run your code safely

Vantrex runs code you write on infrastructure shared with other people. This page says plainly how we keep those apart, what we protect, and what we do not yet do.

Running your code

Every build and every server-rendered app runs in its own container, never directly on the host:

  • an unprivileged user, a read-only root file system, all Linux capabilities dropped and privilege escalation disabled;
  • limits on CPU, memory and number of processes, and a time limit on builds;
  • no route to our private network or to the cloud metadata service, so a container cannot reach our databases, queues or credentials;
  • servers from different projects cannot talk to each other over the container network;
  • outbound mail ports (25, 465, 587) are closed to stop abuse.

Builds run with an allow-listed environment: only the variables you set for the project reach them. Platform secrets are never passed. Pull requests from forks are never built, because that code is not yours.

Containers share the host's operating-system kernel. They are a strong boundary but not a hardware one. We do not claim protection against an unknown kernel escape; the controls above reduce what an attacker who found one could reach.

Protecting your data

  • Traffic to the dashboard, the API and your deployments uses HTTPS. Certificates for custom domains are issued automatically.
  • Environment variables are encrypted at rest, and their values cannot be read back through the dashboard or API once saved.
  • Passwords are stored as salted hashes. Two-factor authentication and passkeys are available. API keys are shown once, are scoped, and can be revoked.
  • Secret-looking files (such as .env files, private keys and credential files) are never uploaded by the CLI.
  • An audit trail records sign-ins and changes to your account and projects.
  • Servers are administered through AWS Session Manager. No server accepts SSH from the internet.

Protecting your sites

Each project has a web application firewall with a managed ruleset and your own rules, and the edge records mitigated requests. Domains you attach are verified and re-verified.

What we do not do yet

  • We have not had an independent penetration test or a formal certification (such as SOC 2 or ISO 27001).
  • Backups and recovery are described in our terms; we do not offer a contractual uptime guarantee. Live status is at status.vantrex.cloud.

Reporting a vulnerability

Email security@vantrex.cloud with what you found, how to reproduce it, and any impact you have confirmed. Our machine-readable policy is at /.well-known/security.txt.

  • We will acknowledge your report within 3 business days and keep you informed until it is fixed.
  • Please give us reasonable time to fix a problem before you disclose it, and do not access other people’s data, degrade the service, or run automated scanning that generates heavy load.
  • If you follow these rules we will not take legal action against you for good-faith research.
  • Testing your own projects and account is always fine. Testing someone else’s project is not.

We do not currently offer a paid bounty, but we are glad to credit you if you wish.

Reporting abuse

To report a site hosted on Vantrex that is phishing, distributing malware or otherwise abusive, email abuse@vantrex.cloud with the address and what you saw.