Security overview

Justikail holds credentials that grant shell access. That makes the platform a high-value target, and it shapes every design decision below.

Connection secrets

• Secrets are encrypted at rest and decrypted only in memory, at the moment a session is established.
• A secret is never sent to the browser, never included in an API response, and never written to logs.
• Secrets are passed to the connection process through the environment or standard input, never as command-line arguments, which would otherwise be visible in the process list.
• A stored secret can only ever be replaced, never read back — not by you, and not by us.
• Deleting or rotating a connection scrubs the stored secret.

Isolation between accounts

Cross-account access is blocked at several independent layers, on the assumption that any single layer might fail:

1. Query scoping. Connections are always filtered by owner.
2. Authorisation policies. Every action re-checks ownership, and denies by default.
3. Single-use session tokens. Opening a terminal requires a short-lived token bound to one user, one connection and one session.
4. Server-side re-verification. Ownership is checked again when the terminal connection is established.
5. No client-supplied identity. The target is derived from the validated token, never from anything the browser sends.

Administrators cannot reach your servers

This is a deliberate boundary, not a policy promise. Administrative privileges cover platform concerns such as content and abuse handling. They explicitly do not extend to opening a terminal or decrypting a secret that belongs to another account — those actions are governed solely by ownership.

Sessions

• Idle timeout and an absolute maximum session duration both apply.
• Concurrent sessions per account are capped.
• Closing the browser tears the session down; processes are cleaned up rather than left running.
• Reconnecting requires a fresh authorisation, not a replayed token.

Infrastructure

• The terminal service runs isolated from the main application, as a non-root container.
• Its outbound network access is restricted to the relay network, so it cannot be repurposed as a general-purpose jump host.
• Traffic is TLS-encrypted end to end.

Auditing and privacy

We record session metadata — who connected to which connection, when it started and ended, and why it ended. We do not record terminal contents, keystrokes or command output. Audit entries never contain secrets.

Reporting a vulnerability

If you believe you have found a security issue, please report it before disclosing it publicly. We will not pursue action against good-faith research that respects our acceptable use policy and does not access other people's data.

Justikail is in beta and under active development. This page describes the controls the platform is built around; it is not a compliance certification.