Security & Vulnerability Policy
Relevant source files
The following files were used as context for generating this wiki page:
Daytona maintains a rigorous security and vulnerability policy designed to protect the platform, its users, and the integrity of isolated sandbox environments. The policy defines clear procedures for reporting vulnerabilities, establishes the scope of security research, and provides a "Safe Harbor" for researchers acting in good faith. This policy is integral to the project's Code of Conduct and developer contribution workflows.
Sources: SECURITY.md:1-10, CODE_OF_CONDUCT.md:1-10
Vulnerability Reporting Process
Daytona prohibits the reporting of security vulnerabilities through public GitHub issues. Instead, a coordinated disclosure process is enforced to ensure remediation before public exposure.
Reporting Channels
Researchers can report vulnerabilities through two primary private channels:
- Email: Direct communication via security@daytona.io.
- GitHub Security Advisories: Private reporting through the GitHub security advisory feature.
Reports must include a description of the vulnerability, reproduction steps, an impact assessment, and any supporting proof-of-concept material.
Sources: SECURITY.md:3-16
Disclosure Timeline
The project follows a specific timeline for response and remediation:
| Milestone | Target Timeline |
|---|---|
| Acknowledgement | Within 2 business days |
| Initial Assessment | Within 5 business days |
| Remediation | Target within 90 days |
| Public Disclosure | 30 days after patch release |
If no response is received within 90 days, researchers may proceed with public disclosure after providing a 14-day advanced written notice.
Sources: SECURITY.md:18-24, SECURITY.md:95-103
Security Architecture & Scope
The security policy covers the entire Daytona ecosystem, with particular focus on the isolation boundaries of the sandbox runtime.
In-Scope Assets
The following components are strictly within the scope of vulnerability reporting:
- Daytona Platform: The web application (app.daytona.io) and management interfaces.
- API and SDKs: Documented and undocumented endpoints and client SDKs.
- Sandbox Isolation: Host escapes, cross-tenant access, and isolation boundary bypasses.
- Secrets Management: Unauthorized access to secrets or leakage across boundaries.
- Authentication: SSO, API key management, and privilege escalation.
Sources: SECURITY.md:28-36
Exclusions and Design Intent
Certain behaviors are excluded from the vulnerability program because they represent intentional design choices or low-impact scenarios.
The diagram shows the logic for triaging vulnerability reports based on scope and defined exclusions.
Sources: SECURITY.md:38-65
Security Controls & Best Practices
Daytona implements several security layers across its codebase and deployment configurations to mitigate common risks.
API Key and Permission Management
In the dashboard application, API keys are managed with specific permissions (e.g., WRITE_SANDBOXES, DELETE_SANDBOXES). Key values are masked in the UI by default to prevent shoulder surfing or accidental exposure.
Sources: apps/dashboard/src/pages/Onboarding.tsx:55-75, apps/dashboard/src/pages/Onboarding.tsx:142-155
Auth0 and OIDC Integration
For local development and production deployments using Docker Compose, Daytona utilizes OIDC for authentication. This includes:
- SPA Configuration: Allowed callback and logout URIs restricted to specific local and proxy domains.
- M2M Applications: Scoped permissions for the Management API (e.g.,
read:users,update:users). - Custom API Scopes: Granular permissions such as
read:workspacesandwrite:registry.
Sources: docker/README.md:37-112
Sandbox Isolation Security
The coding agent is instructed to maintain sandbox isolation and resource limits, validate file paths to prevent directory traversal, and handle sensitive data appropriately in outputs.
Sources: guides/typescript/mastra/coding-agent/openai/src/mastra/agents/coding-agent.ts:160-168
Enforcement and Conduct
The security of the community is also governed by the Contributor Covenant Code of Conduct. Community leaders are responsible for maintaining a safe environment by taking corrective actions against harassment or inappropriate behavior.
Reporting Conduct Violations
Instances of abusive or harassing behavior should be reported to codeofconduct@daytona.io. Community leaders are obligated to respect the privacy and security of the reporter.
Sources: CODE_OF_CONDUCT.md:52-58, CONTRIBUTING.md:14-19
Safe Harbor & Rewards
Daytona provides "Safe Harbor" for researchers who act in good faith. This means the project will not pursue legal action if researchers avoid service disruption, do not exfiltrate user data, and follow the coordinated disclosure timeline.
Reward Structure
Valid, original findings that demonstrate real security impact may be eligible for rewards:
- Range: $100 to $1,000.
- Criteria: Severity, exploitability, and report quality.
- Duplicates: Credited only to the first submission.
Sources: SECURITY.md:73-93, SECURITY.md:105-107
Summary
The Daytona Security & Vulnerability Policy ensures a resilient infrastructure by combining proactive reporting channels, defined architectural boundaries, and strictly enforced community standards. By utilizing private disclosure and offering safe harbor, Daytona fosters a collaborative environment for security researchers to improve the platform's isolation and data protection mechanisms.