Security
shield
Isolation Model
- • Each deployment runs in its own Docker container.
- • Non-root execution; strict CPU & memory limits per compute class.
- • No persistent volumes on free tier — state is ephemeral.
- • Request timeouts enforced at the gateway.
- • Curated registry — users cannot upload arbitrary images.
key
Credential Handling
- • API keys are bcrypt-hashed at rest; only the prefix is stored in plaintext.
- • Keys are returned in the clear exactly once at creation.
- • Sessions signed with iron-session (AES-256).