Security model
Even a compromised Unrent cannot destroy your data.
Unrent never connects to your servers: an agent on each server connects out and runs only signed jobs with fixed schemas. Destructive and policy changes also need a passkey approval that the agent verifies itself, and secrets are sealed in your browser to keys only your servers hold.
- Kind
- db.restore.promote
- Server
- acme-fra-1
- Resource
- production/orders
- Requested by
- dev@acme.example
- SHA-256 you sign
- q8Zr…V2c
Five rules the design keeps
- 01
No inbound access
The control plane never connects to a server and never holds an SSH key, a password or a long-lived credential for one. The agent dials out.
- 02
Typed jobs, never strings
There is no remote shell, no “run this command” job, and no field whose value reaches a shell. The agent validates every job against its schema before acting.
- 03
A passkey for anything destructive
Destructive and policy jobs carry an approver’s WebAuthn signature over the exact job. The agent checks it against its own list of approvers.
- 04
Secrets Unrent cannot read
Values are sealed in the browser with age (X25519) to the server’s key. Unrent stores ciphertext; even a buggy agent cannot hand it a plaintext database password.
- 05
Fail closed
An unknown job kind, a missing field, an expired signature, an empty key list or a policy the agent cannot parse all mean: refuse.
If someone breaks in
What each attacker could do, and what the design stops.
| Who | Could | Cannot |
|---|---|---|
| Someone on the internet | Reach your apps on ports 80 and 443 | Reach the agent (it has no listener) or your databases (never published) |
| Someone with a stolen enrollment token | Enroll one server, once, within 15 minutes | Reuse the token, or read secrets meant for other servers |
| Someone with a member’s session but no passkey | Read and do what that member’s role allows | Approve destructive or policy jobs, or change approvers |
| A compromised Unrent | Send non-destructive jobs and read ciphertext and metadata | Restore over production, point backups at another bucket, raise an agent’s limits, add approvers or read secrets |
| Someone with root on one of your servers | Everything on that server | Act as your other servers, or sign jobs |
On your server
unrentd, the networked part, runs as an unprivileged user with a read-only file system and no capabilitiesunrent-exec, the root helper, has no internet access, listens only on a root-owned socket, and re-verifies every signature- Each server’s mode limits what it accepts: observe (read-only), protect (backups and alerts, apps left alone) or manage; lowering it works locally, without Unrent
- Logs and job output pass a redactor before they leave the server
- If Unrent is unreachable, containers, cron jobs, backups and certificate renewals keep running
In the control plane
- Each organisation’s data lives in its own Durable Object; every request resolves the organisation from the session first
- Sign-in with passkeys; a new address is proven with a one-time email code
- Roles (owner, admin, developer, viewer) plus a separate approver flag that needs a registered passkey
- An append-only audit log, each row hashed with the previous, with the agent’s signature on job results; exportable and verifiable offline
- Model API keys and secrets are never stored, logged or returned in clear
Releases
The installer checks every agent release against both its manifest and the release’s SHA256SUMS before it writes anything, and each release carries GitHub build provenance (gh attestation verify). Verify a release yourself.
Coming Signed one-click agent updates with automatic rollback (built, waiting for the release signing setup), and the agent’s source in a public repository under Apache-2.0.
Questions
Does Unrent have SSH access to my servers?
No. Unrent never holds an SSH key or password for your servers, and the agent opens no port. Servers Unrent creates on your cloud have no SSH key you could use and no root password unless you add a key.
Can Unrent staff read my secrets?
No. Secret values are encrypted in your browser to keys that exist only on your servers. Unrent stores the ciphertext and cannot decrypt it.
How do I report a vulnerability?
Email security@unrent.dev. Please do not open public issues for security reports. See the disclosure page for what to include.
Your servers, your keys. Start with one free server.
The first server is free, then $2 per server per month, with nothing gated.