Security Model

Container isolation

Every container on hzel is unprivileged and sandboxed. Containers cannot access the host system, each other's filesystems, or host devices. CPU, memory, and network limits are enforced at the platform level — you cannot exceed them, and other tenants cannot affect your resources.

Authentication and authorization

Every API request is authenticated before any action is taken. Ownership is checked on every container operation — you can only act on containers that belong to your account. Requests that fail either check return immediately with no side effects.

Sessions issued through OAuth have a 15-minute access token lifetime. Personal Access Tokens can be given an explicit expiry or revoked at any time from the dashboard or API.

Command execution

Commands run inside your containers are executed in an isolated context with no access to the host or other containers. Each command runs as a job and produces a structured output stream — no raw shell access to the host is involved.

Audit log

All security-relevant actions are recorded — authentication events, container lifecycle changes, token creation and revocation, and command execution. Each log entry includes the timestamp, the actor, the target resource, the action taken, and the outcome.

Audit logs are available through the dashboard and the API. They cannot be deleted.

Get audit logs

Admin only. OAuth application tokens are rejected even for admin accounts — use a PAT or browser session. See AuditLogRecord for the full field reference.

Responsible disclosure

If you discover a security issue with the hzel platform, please contact us at security@hzel.org. Do not open a public issue.