| The server | The control plane and every app run as the unprivileged russel account. Nothing runs as root after install. An app that escaped its sandbox would land in that account, with no sudo, no SSH keys, and none of your files. |
| The API | Every request needs the token: at least 32 characters, compared in constant time. The control plane refuses to listen on a public address without one. |
| The connection | The control plane speaks plain HTTP on 127.0.0.1 only. Reach it through an SSH tunnel or an HTTPS proxy. The CLI and dashboard refuse to send the token over plain HTTP to another host. |
| Apps | Containers are rootless, drop all Linux capabilities, can’t gain privileges, and have a read-only root. MicroVMs (experimental) add a separate kernel. |
| Secrets | Stored with mode 0600 in a 0700 folder, never returned by the API, and never put on a command line. Containers receive them as Podman secrets. |
| Input | Service names, paths, env vars, secret names, and Podman flags are checked before use. The Russelfile must be a real file in the repo, under 1 MiB. |
| Git URLs | Only https://, http://, ssh://, and git@ URLs. Hosts that are, or resolve to, private, loopback, link-local, or cloud-metadata addresses are refused, and HTTP redirects are not followed. |