Security

Infrastructure designed for controlled execution.

Agents and CI jobs run untrusted and generated code. OhMako assumes that, and isolates every workload with its own microVM, scoped credentials, and enforced limits.

security · isolated instance · egress: denied

sandbox / acme-api@feat-limiter

GET /v1/users/:id

POST /v1/export

GET /v1/files?path=

POST /v1/auth/token

source analysis · 3 candidates

Architecture

Controls at every layer.

Firecracker isolation

Every job and agent runs in its own microVM with a dedicated kernel.

Ephemeral environments

CI machines are destroyed after each job. Nothing carries over.

Short-lived OIDC credentials

Workloads receive scoped, expiring identity tokens instead of static keys.

Role-based access control

Organization, project, and environment permissions.

Secret handling and redaction

Secrets are injected at runtime and redacted from logs.

Audit trails

Who — human or agent — did what, where, and when.

Snapshot secret scrubbing

Credentials are removed before snapshots are captured.

Resource and execution limits

Bound CPU, memory, time, and spend per workload.

Restricted networks for testing

Security testing runs with egress restrictions against isolated instances.

Organization and project policies

Centrally define what can run, where, and on which branches.

Security testing

We test copies, not your production.

AI security testing instantiates your application from a branch inside an isolated, network-restricted environment. Exploit validation runs only against that instance. OhMako does not test or attack customer production systems.

Compliance attestations are not claimed on this page. For questionnaires or architecture reviews, contact us.

Build the next generation of software delivery.

Give your developers and AI agents the infrastructure to build, validate, and ship software without the operational friction.

Get started Explore documentation