Security and privacy

Isolation

• One sandbox per run, non-root, with CPU, memory, disk and time limits, no shared volumes, destroyed when the run ends.
• Network allowlist: by default only GitHub, package registries and the Ingot model gateway. No access to Ingot's database or internal services.

Secrets

• Ingot's own secrets never enter a sandbox.
• A sandbox only gets two short-lived credentials: access to the one repository for that run, and a model token for that run. Both expire when the run ends.
• Your GitHub token is stored encrypted and stays on the Ingot server.

Redaction

A secret scanner runs on run events, logs, memory, PR text and notifications before they are stored or sent.

Memory you control

Zaprex remembers your preferences (for example your PR style) and facts about each project (build and test commands, conventions, flaky tests). Everything is visible, editable and deletable in the Memory tab, and you can forget a project in one step. Zaprex refuses to save anything that looks like a credential.

Untrusted input

Repository content and model output are treated as untrusted. Risky tools are gated by the policy engine and approvals, which run outside the model.

Abuse protection

Per-user rate limits, compute caps and the admin kill switch.

Your data

Zaprex uses your Ingot account and stores its data (tasks, runs, run logs, routines, memory, notifications) in the same Ingot database. See the privacy policy.