Untrusted code, by default.
djustlive runs code from many customers on shared hardware, so we assume any app could be hostile and build the platform around that.
What the platform does today
- Every app runs in its own Firecracker microVM, not a shared container.
- A microVM can only use its own network address, and its traffic to the host and to internal networks is restricted to what the app needs to serve requests.
- The system image is a read-only filesystem; an app's changes go to its own overlay.
- HTTPS everywhere, with Let's Encrypt certificates issued and renewed for you — custom domains too.
- SQLite apps replicate continuously with Litestream.
- Platform storage is backed up offsite every hour.
- Each project's database password is encrypted at rest, with rotatable keys.
- Plan limits on apps and custom domains are enforced by the platform.
- Sign in with email and password, GitHub, or Google.
Reporting a vulnerability
Email security@djustlive.com with a clear reproduction. For high-severity issues we aim to acknowledge within two business days and ship a fix or compensating control within thirty days. We'll credit you publicly if you'd like.