Assume repository content is hostile
Source code, configuration, comments, screenshots, logs, model output, and browser content are all untrusted. Security comes from capability separation, not prompt instructions or secret filtering.
Looking for security reviews of your code? The security and code-quality review guide explains findings, audit scope, and fixes for GitLab and GitHub workflows. This page describes how Code Voucher handles your data and execution.
Trust boundary
Untrusted
Repository and browser input
Code, metadata, pages, logs, screenshots, and model output may be hostile.
Isolated
Bounded execution
Attempt-scoped runners receive narrow capabilities and no publisher credential.
Trusted
Control plane validation
Structured results, scope, policy, and artifact classification are verified.
Trusted
Publisher
Only classified summaries and statuses cross into provider systems.
Default boundaries
- Agent and browser sandboxes receive no GitLab, GitHub, Slack, Linear, publisher, or SaaS database credentials
- The CI bridge receives a short-lived, stage-specific GitLab OIDC token, not a reusable secret
- Human GitHub and GitLab OAuth grants and refresh tokens are not retained after sign-in
- Repository access is supplied separately through an encrypted workspace GitLab service-account token or a scoped GitHub App installation credential
- Raw reports and artifacts remain dashboard-only by default
- Only the trusted publisher can write provider statuses or comments
- Agentic QA uses synthetic data and attempt-local dependencies; public execution additionally requires externally enforced egress denial
- Repository-controlled limits may only reduce platform budgets
Publishing findings
The dashboard preserves private evidence. Posting an MR summary is an explicit repository setting, as is GitHub pull request feedback. Before publication, structured findings are validated against changed hunks and classified for the destination. Obfuscation filters are defense in depth, not the secret boundary.
Runtime QA execution boundaries
Internal runtime QA
Shared Docker executor
Used to iterate on first-party repositories. It is not an acceptable public multi-tenant boundary.
Customer runtime QA requirement
Ephemeral VM or microVM
Customer execution requires externally enforced isolation, egress policy, resource ceilings, and destructive teardown.
Report a vulnerability
Do not include secrets or exploit details in a public issue. Contact the Code Voucher team through your private support channel and include the affected run ID.