Security

Audits routinely handle production credentials, so the design assumption is that every layer between you and the sandbox is untrusted — including our own web application.

Credentials are sealed, not stored

• Credentials are encrypted in your browser to the audit worker's public key before they leave the page. The web application and database hold only ciphertext they cannot decrypt.
• Decryption happens once, on the isolated worker, at run time. Values are injected into the sandboxed run environment — never logged, never included in prompts, and scrubbed from all evidence artifacts before upload.
• The ciphertext is deleted the moment your audit reaches any terminal state, with a daily sweep as a backstop.

Runs are isolated

• Every run executes in a fresh, disposable sandbox — no shared state between runs or customers.
• Agents in free journey demos run with hard tool restrictions: web access only, no shell and no filesystem, enforced at the agent runtime.

Access is scoped

• Audit results are reachable only through signed, expiring links scoped to a single audit.

Reporting

Found a vulnerability? Email admin@vorza.dev — we respond within two business days and appreciate coordinated disclosure.