# Security

**The boundary is the host, never the guest.** You have root in the VM, and an agent may run hostile code, so nothing inside a guest is trusted.

| Topic | Today | Planned |
|---|---|---|
| Tenant isolation in the API | Built and tested | |
| Snapshots encrypted per sandbox | Built and tested | |
| Delete destroys the key first | Built and tested | |
| Secrets stay out of the guest by default | Built and tested for the proxy | |
| VM isolation | One VM per sandbox | Needs host hardening |
| Firewall outside the guest | At the edge | On each host, with eBPF |
| Measured boot | | On owned hosts |
| Core scheduling between tenants | | On real hosts |

Reporting a problem: quote the `request_id`. A disclosure address comes with a public service.