Security & sandboxing
Every app Fullstack Agent Coding builds runs in its own isolated environment — it can't reach your Nexrall account, your other apps, or your files unless you explicitly wire them in. This page explains the boundaries.
Per-app isolation
- Each app runs as its own Cloudflare Worker, with its own scoped database (D1), key-value store (KV), and object storage (R2).
- An app has no access to your Nexrall account data beyond what you explicitly wire into it (for example, a connector you connect).
- Published apps get the same isolation as drafts — publishing an app to the Store doesn't loosen its sandbox.
Secrets
- API keys and credentials are stored as app secrets, never in source code. The agent sees secret names (
list_secrets), never their values. - When an app needs a key, the agent asks you for it (
request_secret) rather than inventing or hard-coding one. - Server logs and test output have secret values scrubbed before they're shown.
Connectors & credentials
- Connecting a service (Supabase, Firebase, VNPay, …) stores credentials as app secrets and records an audit trail — you can see exactly when a credential was granted or revoked.
- A live-key guard prevents the agent from exercising a real production key while testing: it won't charge real money or email real people against a live credential unless you confirm that's actually intended.
Sandboxed build
While building, the agent's bash runs in a sandbox with:
- No network access (no
curl/wgetto reach out). - Destructive commands blocked — dropping a table, force-pushing, and similar are refused.
- Secret access blocked — the sandbox can't read configured secrets.
The run_js and run_test_script tools run in isolated browser contexts with no access to your app's database or secrets, and no open internet — run_test_script can only reach the app's own origin.
Custom domains
If you attach a custom domain, it's provisioned through Cloudflare for SaaS, which manages the TLS certificate and HTTPS for you — you never hand the app an unencrypted endpoint.
Guardrails on the agent itself
Beyond the sandbox, the agent runs on deterministic integrity guardrails (described in the Overview): a progress ledger, a test-integrity guard, a claim-vs-evidence check, and cross-file breakage detection — so it can't quietly drop code, weaken a test to pass, or claim "all green" when the record says otherwise.