Security model

• VM isolation. Each sandbox runs in a hardware-isolated VM with its own kernel. Its only channels to the host are the guest agent and the egress proxy.
• Network. Private, link-local and cloud metadata addresses are never reachable, whatever the sandbox's policy. An operator can open specific intranet hosts with KUMOBAD_ALLOW_PRIVATE_HOSTS; loopback, link-local and the host's own addresses stay blocked even then.
• Corporate proxies. With KUMOBAD_UPSTREAM_PROXY, kumobad resolves and checks each destination itself before tunnelling through the proxy. The guest's TLS session runs inside the tunnel.
• Secrets. Values stay on the host. The guest only holds a placeholder, and the real value goes only into HTTPS requests to the hosts you allow. See How secrets work.
• Previews. Links are signed, bound to one sandbox and port, and expire. Browsers load them from a separate listener (127.0.0.1:7789) that serves nothing else, so a page from a sandbox can't reach the API. Redirects stay inside the preview.
• Known limit. All previews share one browser origin, so browser storage such as localStorage is shared between sandboxes' pages. Don't open untrusted previews in a browser profile whose preview storage matters. Per-sandbox origins are planned.
• Daemon access. The Unix socket is mode 0600, and the TCP listeners accept loopback connections only.

kumoba runs untrusted code, so isolation bugs matter more here than in most projects. Thank you for reporting them privately.

Reporting a vulnerability

Use GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. Please do not open a public issue or pull request for a security problem.

Include what an attacker controls (guest code, an HTTP client of kumobad, a network peer), what they gain, and the smallest reproduction you have. You will get an acknowledgement within a week, and a fix or a plan once the report is confirmed. Credit goes in the release notes unless you prefer otherwise.

Scope

In scope: escaping a guest to the host, reaching another sandbox, bypassing the egress allowlist or the private-address blocks, reading a secret's value from inside a guest, forging or reusing preview links, and authentication bypass on the kumobad API.

Known limitation: browser previews from all sandboxes share one origin (127.0.0.1:7789 by default), so web storage written by one sandbox's page is readable by another's. Per-sandbox origins are planned.

Out of scope: denial of service by a client that holds the bearer token, and attacks that need the host's root account. libkrun and libkrunfw issues belong upstream at containers/libkrun, though a heads-up here is welcome.

Supported versions

Before 1.0 only the latest release gets security fixes.