Security
Security, and how to tell us about a problem
How SandboxVille is built
- Each room runs in its own sandbox and gets only what its door sign lists.
- A guard checks each room request against the sign. Refusals show in red on the Security Office wall.
- Only your paired browser can place or remove a room. An AI helper cannot do it through SandboxVille.
- Each room zip is checked against a fingerprint (sha256) on our list before it is placed. A changed file is refused.
- Normally SandboxVille listens only on your own computer (127.0.0.1) and refuses requests that do not come from its own address. Exception: friend mode ("SandboxVille for friends on my WiFi") opens a visitor door that other devices on your network can reach. That door is not encrypted and does not carry your private controls.
- We attacked it ourselves in two rounds of testing and fixed the real problems we found.
No software is perfectly secure. See our known issues for limits we know about.
Found a security problem? Tell us
Email [email protected]. Please include what you did, what you expected, what happened, your SandboxVille version, and your system (Windows, Mac or Linux). A short video or screenshot helps. Do not send other people's data, passwords or keys.
We use email because SandboxVille's code is not public, so there is no public issue tracker.
What to expect from us
- We reply within 3 business days to say we got your report.
- We tell you within 10 business days whether we could reproduce it.
- We fix serious problems first and tell you when a fix is out.
- We credit you in the release notes if you want, and not if you do not.
- We do not run a paid bug bounty.
Please
- Test only on your own computer, with your own data and your own accounts.
- Do not test other people's computers, our website's hosting, Discord, Gumroad, or any AI company's service.
- Give us a reasonable time (90 days, or less if we fix it sooner) before you tell others.
- If you reach anyone else's data, stop, do not keep a copy, and tell us.
Good-faith research
If you follow this page in good faith, we will not bring a legal claim against you over your research, and we will consider it authorized under our terms. This promise is only from us. It cannot cover other companies, and it does not change any law.
Out of scope
Problems in an AI tool's own program, in a cloud AI company's service, or in your operating system (please report those to their makers); attacks that need someone to already control your computer or user account, apart from items on our known-issues page; social engineering of people; denial-of-service against our website.
Room problems
If a room breaks its own door sign, email [email protected] with the room's name and version. We can change its fingerprint on our list so the old copy is refused.
Version support
We fix security problems in the latest version. To get a fix, download the new version.
A machine-readable contact file is at sandboxville.com/.well-known/security.txt.