Security
How Codegenix isolates tenants, sandboxes code execution, and protects your secrets.
Tenant isolation
Every workspace's data lives behind Postgres Row-Level Security. Each workspace's auto-provisioned backend is a separate Supabase project, so one tenant's tables are never reachable from another's.
Sandboxed execution
Generated apps run in StackBlitz WebContainers (an in-browser runtime) or E2B Firecracker microVMs — never directly on shared infrastructure. The agent worker bounds every run with wall-clock, concurrency, and cost caps.
Secret handling
Bring-your-own-key provider credentials are encrypted at rest with AES-256-GCM under a versioned key id. Server-only secrets never carry a NEXT_PUBLIC_ prefix; the structured logger and the error tracker scrub secrets and PII through one shared deny-list before anything leaves the process.
Request hardening
Mutating API routes enforce same-origin (CSRF) checks, authentication, workspace role, and rate limits, and write an audit row. Responses carry HTTP Strict-Transport-Security, a Content-Security-Policy baseline, and a restrictive Permissions-Policy. The agent's web-fetch tool is SSRF-guarded and pins its connection to a pre-validated IP.
Reporting a vulnerability
Email security@codegenix.dev with a description and reproduction steps. We aim to acknowledge within three business days. Please do not open a public issue for security reports.
Compliance
Codegenix is pre-general-availability. Formal certifications such as SOC 2 are on the roadmap and are not yet attained — this page describes current engineering practice, not a certification claim.