The promise

sandcastle runs jobs from sources you do not trust. This page says, in plain words, what those sources cannot do to you. The threat model says it in full, with an id for each promise, and says what lies outside it. The test matrix links each id to the tests that prove it.

A source you configured, or the content of one of its jobs, cannot

• read your keys or tokens;
• reach your internal network, by a redirect or by DNS;
• leave anything on your machine that outlives the job;
• spend more than the jobs per hour you allowed it;
• see or change the jobs of another source.

A program running in a box cannot

• read your keys or tokens;
• reach any network;
• leave files or processes behind;
• read the records of other jobs;
• use more memory, processor, processes or time than its box has.

A reply from a model is never run

It goes back, as text, to the source that sent the job, and to no other. It cannot make sandcastle send a request or read a file, and each job asks the model once at most.

Another account on your machine cannot

read your keys, tokens or records, see a secret in the list of processes, hand sandcastle a job, or use the gate.

Only what is proved counts

The promise holds for a version: a tag that passed every test of the matrix on the reference machine. Whatever lies between versions is work in progress.

The promise does not cover your machine’s root, programs that run as your own user, a tampered sandcastle, or how much a provider charges you. The threat model lists all fourteen points outside it. The money you can spend is capped by the spending limit of your workspace at the model’s provider, and setting that limit is not optional.