Security

An agent runs code a model decided to run, in your repository, with credentials. Overnite is built on the assumption that any agent can be tricked into doing something it should not: every workspace is treated as untrusted, and every secret reaches only the process that needs it, for as short as it can.

To report a vulnerability, email security@overnite.dev.

Workspaces are sandboxed

• gVisor. Every workspace runs under gVisor, a kernel implemented in user space: the agent's system calls reach gVisor, not the host's kernel. The cluster refuses to start a workspace without it - an admission policy rejects any workspace machine that does not ask for gVisor.
• One machine per workspace. Its own filesystem, its own disk, its own processes. Agents in one workspace share that machine; nothing is shared between workspaces.
• Root inside, nothing outside. Agents run as root so they can install packages, inside the sandbox. Workspaces cannot run privileged containers, mount host paths, use host networking or add kernel capabilities, and get no credentials for the cluster they run in.
• Network. Nothing connects into a workspace: its runtime dials out to Overnite. Out of a workspace, three things are allowed - DNS, Overnite's realtime service, and the public internet (model APIs, git remotes, package registries). Private address ranges, the cloud metadata address and every other internal service, including Overnite's database, are unreachable.

Tokens

The credentials in a workspace are as narrow as they can be made.

• Git. A workspace never gets your GitHub token. It gets a token GitHub issues to the Overnite GitHub App, for the workspace's one repository, with contents, pull requests and issues access and nothing else. It expires within an hour and is replaced while the workspace runs. It lives in memory-backed storage and in agents' environments, never on the workspace's disk.
• Model keys. A key you save reaches one agent at a time, of the kind you saved it for - a Claude key never reaches Codex - in that agent's own environment, when it starts. It is never in the runtime's own environment.
• A clean environment. Agents start with an allowlist of variables (PATH, HOME, TERM, locale, the git token and the local socket), not a copy of the runtime's. CLAUDE*, ANTHROPIC* and OPENAI* variables are never inherited, whatever else changes.
• Connectors. A connector's token reaches only the agents that select it, the same way as a key (Connectors).
• Runtime token. The token a workspace's runtime connects to Overnite with is minted fresh on every wake, scoped to that workspace, and stored by us only as a keyed hash.

What the sandbox does not change: everything inside one workspace can read that workspace's tokens. An agent you start can push to its repository and read the keys of the agents beside it. Give a workspace only the repository, keys and connectors its work needs.

Encryption

• At rest. Every secret Overnite stores - your GitHub token, model keys, sign-in bundles, connector tokens - is encrypted with AES-256-GCM, with a random nonce per value, before it reaches the database. Each ciphertext is bound to the row it belongs to: copied onto another row, or another person's, it does not decrypt.
• Sign-in bundles. When you sign an agent in inside a workspace, only the sign-in files are carried to your next workspace - never conversations - capped at 5 MB and encrypted for your account alone.
• In transit. The cockpit, the API and the WebSocket are HTTPS and WSS only, with certificates from Let's Encrypt.

Your account

• GitHub sign-in, no passwords. The session is a signed, HttpOnly, Secure, SameSite=Lax cookie that lasts 7 days, and the sign-in itself is protected against cross-site request forgery.
• Everything is yours or it does not exist. Every API route answers only for the signed-in person; someone else's workspace answers 404, like one that was never created.
• Approvals are enforced by the server. When Claude Code asks for permission, only an answer sent to the agent lets it continue. A client that fails to show a question cannot answer it for you.
• Logs record the names of the variables an agent was started with, never their values; tokens, keys and OAuth codes are redacted from request logs.

Known limits

We would rather you knew:

• One region, no backups yet. Overnite runs on a single server in Finland, and workspace disks are not backed up during the beta. Push your work.
• Egress is open to the internet. A workspace can reach any public host; connectors limit which credentials it holds, not where it can connect.
• Agents on Auto act without asking inside the sandbox (Agents). Everything their workspace's token allows, they can do; start an agent on Ask to approve each step.
• A connector's GitHub token is read once, when its agent starts, and stops working after an hour. git and gh are unaffected.
• Between Overnite's own services, inside the cluster, some traffic is not encrypted: the network is private to the server, and the workspace policy above keeps workspaces off it.

Reporting a vulnerability

Email security@overnite.dev with what you found and how to reproduce it. We acknowledge within three working days. Test only against your own account and workspaces, and give us reasonable time to fix an issue before you tell anyone else - the full policy, including safe harbour for good-faith research, is at overnite.dev/security.