Security

Ramus is built so that running untrusted app builds — which is what a PR is — stays safe by construction, not by policy.

Isolation by default

Every build and every preview session runs in its own hardware-isolated virtual machine (Cloud Hypervisor / KVM microVMs), created fresh and destroyed after use. Sessions never share a device: each reviewer gets a private VM. Use Back or End session to release it immediately; closing a tab only disconnects that viewer, and the unattended session is reclaimed by its idle timeout.

Access control

• Reviewers sign in with GitHub. Opening a preview checks, live, that the account has access to the repository on GitHub — collaborator access is required.
• Preview links are not capability URLs: following one without repository access shows "No access", not the app.
• Session streams are authorized with short-lived, single-use tokens sent over the encrypted connection itself — never in URLs, so they can't leak via logs or browser history.

What Ramus can and cannot see

• The GitHub App requests the minimum needed: reading the repositories you select, PR metadata, and posting its status comment.
• Clone credentials are short-lived, repository-scoped tokens minted per build. Build hosts hold no standing GitHub credentials and no database access.
• Ramus never reads your app's runtime data or secrets. Build environments are discarded after every build; device VMs are discarded after every session.

Data retention

Questions about security, or found something? Email [email protected] — security reports get priority.