security boundaries
How source capture, credentials, execution and retention affect a security review.
For: Advanced: security and data handling
A security review covers several boundaries: which source leaves the repository, who can submit work, where it executes and how long its data remains available. This explanation describes the documented model; release-specific evidence and the beta agreement determine what a company can rely on.
source uploads
Source capture includes tracked files and non-ignored untracked files. A file can therefore be uploaded before it is committed. Ignored files are omitted, so they cannot supply required build inputs through an ordinary capture.
Repository authorisation controls whether a repository can be used; it does not inspect every selected file for credentials. The source preparation guide covers checking the capture before submission.
credentials
API authentication identifies the caller and its scopes. Repository authorisation is a separate check. Separate identities for people and agents make actions attributable and allow access to be restricted by task.
The Sorus caller token gives authority to the client, not to the customer’s build. Exposing it to untrusted pull-request code would cross that boundary. The authentication guide covers credential setup; suspected exposure requires the account’s rotation and revocation process.
execution and network
The architecture uses a Firecracker guest for each job and a controlled dependency path. The candidate workload scope excludes unrestricted internet, arbitrary services and private registries.
These constraints affect both security and workload compatibility. A test that depends on an external database may need capabilities outside the offered release. Guest tools, permitted inputs, processing location and isolation evidence need to match the specific release under review.
retention and deletion
Selected artifacts expire 24 hours after original job admission. This is an artifact-retrieval window, not a product-wide deletion policy. Log retention, source retention and deletion terms are established separately.
incidents and vulnerabilities
Account incidents use the agreed beta support channel. For a suspected vulnerability, contact Sorus with a brief description and request a private channel. Keep customer data and credentials out of the initial message.
The security overview lists evaluation questions and current public assurances.