Trust
Security
We run other people's malware for a living, so isolation is the product. Here is how it works, and how to tell us if you find a problem.
How detonations are isolated
- Two separate machines. The website never runs submitted code. Detonations happen on a separate, disposable server that holds no customer data and only connects out to fetch work.
- A sandbox per run. Each run gets fresh Linux user, process, network and mount namespaces, runs as an unprivileged user and is traced at the system-call level. The host's home folders, temporary folders and Detonator's own code are hidden from it.
- No route to the internet. Inside the sandbox every address resolves to a local recorder. Anything a package tries to send is captured as evidence and goes nowhere.
- Fake credentials only. The secrets a package finds are decoys with unique markers. No real key ever enters the sandbox.
- Install scripts run inside. Packages are fetched with install scripts disabled; their scripts then run inside the sandbox, offline.
Namespaces are a strong boundary, not a perfect one, which is why the detonation server is disposable and holds nothing of value.
Your submissions
Uploaded files are stored sealed on the website server and never unpacked there. They are deleted once the detonation finishes. Private reports have unguessable links, and private submissions are never sent to the third-party AI model used in agent runs. See the privacy policy for details.
Reporting a vulnerability
Email [email protected] with what you found and how to reproduce it. We aim to reply within three working days, keep you updated while we fix it, and credit you publicly if you want. Please give us reasonable time to fix an issue before disclosing it, and don't access other people's data or degrade the service while testing.
Our machine-readable contact is at /.well-known/security.txt.
Scope
In scope: detonationlabs.com, its API, and sandbox escapes from a detonation. Out of scope: denial of service, social engineering, and findings that need a compromised user device.
Found malware with Detonator in a public registry? We report it to the registry before publishing details, and share hashes and indicators, never live samples.