If you find a vulnerability in Invincible, please open a private security advisory on GitHub (or email the maintainer) rather than a public issue with exploit details.

Session blobs and Wasm must never contain API keys or sandbox tokens.
Never use NEXT_PUBLIC_SANDBOX_* (or any client-exposed sandbox secret).

When BUILTIN_HTTP_FETCH=sandbox, agent tools may fetch public HTTPS URLs via a Vercel Sandbox microVM (hop B). App-side SSRF policy runs first (https-only; no private/metadata hosts; no redirect follow). Never put Gateway, DO sandbox, or MCP secrets into the Sandbox child env. No NEXT_PUBLIC_* for this feature. See docs/builtin-http.md.

Residual (v1): Policy is preflight-only on the app (literal + DNS at check time). Hop B re-resolves the hostname under Sandbox networkPolicy: allow-all. A short-TTL / DNS-rebinding name could flip to a private or link-local address between preflight and curl. Redirects are not followed. Accept for v1; harden later (IP pin / egress deny) if product needs stronger guarantees.

Zig builds run on a self-hosted GitHub Actions runner (default labels: self-hosted, invincible, zig).

To reduce abuse risk when this repository is public:

1. Default triggers on self-hosted workflows: push to main (path-filtered) and workflow_dispatch.
2. build-harness only also runs on pull_request → main when all of:
   • head branch is in this repository (head.repo.full_name == github.repository) — not forks;
   • author_association is one of OWNER / MEMBER / COLLABORATOR / CONTRIBUTOR;
   • path filter matches harness sources / this workflow.
   • Never pull_request_target. Never Vercel deploy hook on PR. Other self-hosted workflows stay main/workflow_dispatch only.
3. Jobs include if: guards:
   • Opt-in: vars.SELF_HOSTED_BUILDS == 'true' (repository Actions variable, not a secret), or
   • Origin grandfather: github.repository == 'btipling/invincible' (maintainer continuity if the variable is unset)
   • and event is workflow_dispatch, push to main, or the same-repo contributor pull_request rules above (build-harness).
4. Clones / forks must set SELF_HOSTED_BUILDS=true after attaching their own runner. Without that variable, self-hosted jobs skip (safe default).
5. Optional: vars.RUNNER_LABELS as a JSON array (e.g. ["self-hosted","invincible","zig"]). If unset, workflows use that default list via fromJSON.
6. Do not add fork PR or pull_request_target builds on self-hosted without a deliberate design review. Expanding PR CI beyond same-repo contributor heads is a security change.
7. Prefer GitHub setting: require approval for first-time contributors’ workflows; keep fork PR workflows off the self-hosted pool.
8. Host inventory (IPs, droplet IDs) is not published in this repo — keep private notes offline.

Maintainers: still harden the VM (SSH keys, firewall, unattended upgrades) using private runbooks; public docs stay abstract.

The agent sandbox is an optional remote workspace for model tools (list_dir / read_file / write_file / exec). It is not the self-hosted GHA runner that compiles Zig.

Inference is server-side only (POST /api/chat, POST /api/agent). Report client-side key or sandbox-token exposure immediately.

Unauthenticated API when tenancy is on returns 401 with JSON { "error": "Authentication required." } (stable error constant AUTH_REQUIRED_ERROR). Sandbox grant failures return 403 { "error": "Sandbox access denied." } (SANDBOX_FORBIDDEN_ERROR). Inference grant / model failures return 403 / 400 (INFERENCE_FORBIDDEN_ERROR / INFERENCE_MODEL_REQUIRED_ERROR); temporary resolve/catalog failures return 503 (INFERENCE_UNAVAILABLE_ERROR).

Cutover: docs/bring-your-own.md §4a.
OIDC / SCIM operator notes: docs/bring-your-own.md §4b.