CoDev separates the Vercel control plane from untrusted Firecracker guests.

• GitHub user tokens and OpenAI keys are encrypted in PostgreSQL and decrypted only inside server-side Vercel functions.
• GitHub publication uses the GitHub Git Database API from Vercel. Tokens never enter an API body sent to AWS, a microVM environment, a terminal, a clone URL, or a Git credential helper.
• AWS access uses short-lived Vercel OIDC credentials. Long-lived AWS access keys are prohibited.
• Logs redact authorization, cookies, tokens, encrypted values, prompts, file contents, diffs, and terminal output.
• Private repositories are read by the Vercel control plane and transferred to AWS only as credential-free file snapshots. Snapshots reject unsafe paths, submodules, unsupported modes, more than 500 files, individual files over 1 MiB, and total decoded content over 3 MiB.

• Only workspace members with merge capability can publish.
• Publication branches must use the codev/ namespace.
• Existing remote refs are never updated or force-pushed.
• The installation, repository ID, and repository name are revalidated immediately before GitHub mutation.
• The guest export is guarded by the expected integration SHA and bounded to safe tracked/untracked files. Submodules, unsafe paths, unsupported modes, more than 500 files, files over 1 MiB, and exports over 5 MiB are rejected.
• Every attempt has durable pending, published, or failed state and a workspace audit event.

• A sandbox cannot be stopped while agent worktrees are active.
• Automatic hibernation is separate from manual stop: it snapshots the complete guest VM, including active agent worktrees, running processes, and PTY state, before destroying compute.
• A changed integration tree cannot be stopped until its exact source SHA has been published. After destruction, CoDev advances the durable baseline to the remote publication commit so reprovisioning is recoverable.
• Lifecycle cleanup is authenticated with CRON_SECRET, idempotently interrupts turns, releases claims, discards physical agent worktrees, and treats an already-missing sandbox as success.
• Quotas bound active workspaces, queued turns, daily turns, terminal sessions, publication size, and control-plane request rates.

• Feedback requires an authenticated CoDev session and is limited to five submissions per user per hour.
• Records contain category, optional rating, message, page, release, and an optional workspace identifier. CoDev does not automatically attach prompts, source files, diffs, terminal output, GitHub tokens, or provider keys.
• The table has RLS enabled and all Data API access is revoked from anon and authenticated; only the server-side PostgreSQL connection can write it.

• Production dependencies are pinned and the lockfile is checked against pnpm's supply-chain policy before installation.
• The AWS SDK, Smithy signing stack, Sharp, and PostCSS are pinned to patched releases.
• The remaining brace-expansion advisory is reachable only through the Workflow DevKit build CLI and is not bundled into, imported by, or invoked from a Vercel request handler. Replacing it across incompatible major versions breaks the official Workflow compiler, so it is tracked as a build-time upstream exception until Workflow DevKit updates its CLI graph.

Treat unexpected publication refs, secret-shaped log content, cross-workspace access, or a runtime that remains active after cleanup as a security incident. Follow OPERATIONS.md, preserve request IDs and timestamps, revoke affected credentials, and stop the Firecracker host if isolation is in doubt.