Security

Ponzu runs an AI agent on your code, with your credentials, in the cloud. This page says plainly what protects that today, what does not yet, and how to tell us about a problem.

What is in place

GitHub decides who can do what. Who can open a canvas, comment on it and steer it follows who GitHub lets read and push to its repository. The API checks it on every request, and asks GitHub again when its answer is old or a webhook says access changed.
Devices hold no keys to your code. The apps never hold a GitHub, Claude or Vercel credential. They sign in with short-lived tokens for a session our API let in, and signing out ends that session at once.
Secrets are encrypted. Claude credentials, GitHub tokens and repository secrets are encrypted with AES-256-GCM under a key that exists only in the API's environment. Each value is bound to the row it is stored in, so a copy anywhere else does not decrypt.
One sandbox per canvas. Each canvas's agent runs in its own Vercel Sandbox, a Firecracker virtual machine, with a token good for that one canvas.
Short git tokens. The agent pushes with GitHub tokens that last an hour and reach one repository.
Pull requests are held to people. The agent merges, marks ready or turns on auto-merge only in a turn a person started in Ponzu, as that person, and never past the repository's rules on GitHub.
Canvas HTML is contained. It is sanitized on the way in and drawn under a strict content security policy: no script from a canvas runs in the apps.
Your files are on their own domain. A canvas's files are served from ponzu.cloud, never from ponzu.design, so nothing in a canvas shares an origin or a cookie with our site.
Our logs carry no secrets. Our servers' own log lines carry ids and outcomes, never tokens, request bodies or headers, and each line our logger writes is redacted on its way out.

What we are still hardening

The agent works with permissions bypassed inside its sandbox, and that sandbox holds your Claude credential and the repository's secrets in its environment, because Claude Code and your code need them. Anyone whose words reach the agent can try to talk it into doing something else: a person commenting on the canvas, anyone reviewing its pull request (on a public repository, anyone on GitHub), a check's log, or the repository's own files. A command it is talked into could read your Claude credential and the repository's secrets and send them somewhere, and could get a git token that pushes to the repository for an hour.

What limits that today:

Other people's words reach the agent quoted, under instructions that quoted text is feedback and never asks for credentials or for anything to be sent elsewhere.
The sandbox's own token, which talks to our API, is good for one canvas, and the agent's commands cannot read it.
A git token lasts an hour and reaches one repository.
What the agent can do to its pull request is held by our API, not by the prompt.

What we are building: your Claude credential kept behind an egress proxy, so nothing inside the sandbox holds it, and rules for where the agent may connect. Until then, connect Ponzu to repositories whose commenters and reviewers you trust, and give a repository only the secrets its canvases need.

Reporting a vulnerability

Write to security@ponzu.design. Tell us what you found and how to see it happen. Please give us a reasonable time to fix it before you share it. We do not run a paid bounty program.

Good-faith research

We welcome security research on Ponzu. If you look for vulnerabilities in good faith and keep to the rules below, we will not take legal action against you, or ask anyone to, for that research, and we consider it authorized. The rules:

Test only with accounts, workspaces and repositories that are yours, or whose owners agreed.
Don't look at, change or delete other people's data beyond the least you need to show the problem, and tell us at once if you reach any.
Don't degrade the service for others: no denial of service, spam or load testing, and no running up sandbox use beyond what a test needs.
No social engineering, phishing or physical attacks on our people or our providers.
Report what you find to us first, give us a reasonable time to fix it before you share it, and delete any data you got once you have reported it.

This covers Ponzu's own apps, service and website. The companies we work with (GitHub, Vercel, Anthropic and the others on Subprocessors) have their own rules for research on their systems. If you are not sure whether something is allowed, ask us first.

Our security.txt says where to report.

Last updated November 13, 2026.