Skip to content

The ways out we have not closed yet.

We keep this list because you will find these anyway, and we would rather you found them here. Each item says what the gap is, what limits it today, and whether a fix is planned.

Close the ones you can today
Kodela · published limitsAs of 2026-10-04 · orxy V1.7.2.2

Known gaps

Product limits in the current release. Nothing here is a secret, and nothing is left off.

  1. 01
    Egress starts in observeEgress

    Today: Logs and allows; always-on controls for GitHub, DNS and copy ports

    Built, being trialled

    Deny by default is built and being run on our own team first

  2. 02
    npm publish can upload to the npm registryEgress

    Today: Allowed because npm is allowlisted for installs

    Open
  3. 03
    Some AI provider APIs are reachable directlyEgress

    Today: On the allowlist

    On hold
  4. 04
    ssh, scp and rsync to non-standard ports escaped the file-transfer ruleFile transfer

    Today: Closed on workspaces on your host, in observe and deny alike: copy-tool ports are refused, and on any other port the egress proxy recognises ssh, rsync and ftp by their opening bytes and refuses before any of the copy is relayed. Limits: only while File transfer is not both (with both, copying is allowed by design); not on members’ own computers (gap 16); a copy tool hidden inside an ordinary HTTPS connection to an allowed site, or an HTTPS upload to one, is an egress-allowlist question, not this rule; privileged full Docker (gap 18; not on a standard install) drops the firewall guarantee.

    Closed in orxy V1.0
  5. 05
    Desktop IDE attach bypasses file transferFile transfer

    Today: A warning at switch-on; off by default

    By design
  6. 06
    Preview links, and copying what the terminal or an attached editor showsFile transfer

    Today: Detectable in the audit, not preventable

    By design
  7. 07
    Under the open or metered profile, the git token is in the containerCredentials

    Today: The default profile is guarded

    By design
  8. 08
    The per-workspace model key is readable by its developerCredentials

    Today: Useless off your host

    By design
  9. 09
    Containers are not VMsContainers

    Today: No-new-privileges, non-root, limits

    Open

    No custom seccomp or read-only root yet

  10. 10
    The audit chain and authorship record trust the host's root userRecord

    Today: Tamper-evident

    Planned

    Off-box shipping and public signatures planned

  11. 11
    The shared front-door password is unattributable until “require identity” is onAccess

    Today: Setting available, off by default

    Yours to switch

    Turn it on

  12. 12
    Plain HTTP unless you add TLSTransport

    Today: Declare TLS and put a TLS front end in front

    n/a
  13. 13
    No rate limit on workspace creation or invitationsAccess

    Today: Invite-only access

    Open
  14. 14
    The cloudflared image is not pinnedSupply chain

    Today: Every other image and dependency is version- and checksum-pinned

    Open
  15. 15
    No image signing and no automated CVE image scanSupply chain

    Today: Pinned, checksummed dependencies and a CycloneDX SBOM

    Open
  16. 16
    On a member’s own computer, egress and DNS filtering are not enforcedWhere workspaces run

    Today: Off by default: a platform operator grants it and your organisation turns it on. Credentials stay on the platform. Internet access there is observed, not enforced; the source on its disk is readable by whoever uses it; Docker is not available

    Open

    Tested end to end only on Windows; Linux laptops up to enrolment; Mac only in a simulation

  17. 17
    Pulled Docker images are one shared cache on the hostContainers

    Today: Docker is off until your organisation allows it. A workspace sees only images it pulled or built from, but it can tell an image was already pulled

    Open
  18. 18
    Full Docker under privileged drops the firewall and no-credentials guaranteesContainers

    Today: Full Docker needs a platform administrator; privileged is never chosen automatically, only set by an operator, and every create is audited

    By design
  19. 19
    Sign-ins before orxy V1.7.2.2 are not in the audit trailRecord

    Today: Password and shared-credential sign-ins are recorded from orxy V1.7.2.2 on; single sign-on sign-ins are recorded as “signed in with SSO”

    n/a
  20. 20
    Images and PDFs in chat cannot be checked for secretsAI chat

    Today: Typed secrets and text files carrying a credential are refused; PDFs are refused while personal-data masking is on; an admin can turn images or files off

    Open
  21. 21
    Workspaces on your own cloud machines are not shippedWhere workspaces run

    Today: Workspaces run on your host or, if your organisation turns it on, a member’s own computer

    Not shipped

No gaps in this area.

20 items open · 1 closedNone left off

Close the ones you can today

Six of these gaps are defaults you control. None of the six needs a new release.

  1. Switch egress to deny.

    Run egress-proxy summary --days 14 first to see what deny would refuse, then bin/policy set --key egress_enforce --value deny. It applies on the next connection, with no restart.

  2. Turn on “require identity”.

    Once everyone has an account, the shared front-door password stops being accepted and every session names a person.

  3. Put TLS in front.

    Declare TLS and run a TLS front end before the front door. Sessions then carry the Secure flag.

  4. Keep file transfer and IDE attach off.

    Both ship off. If you open file transfer, tighten it per organisation, member or workspace.

  5. Stay on the guarded profile.

    Guarded keeps GitHub and model keys out of the container. Strict adds ref-pattern push rules.

  6. Keep members’ computers and Docker off unless you need them.

    Both ship off. Members’ computers need a platform operator’s grant and your organisation’s switch. Full Docker needs a platform administrator, and privileged is never chosen automatically.

What this list does not cover

It lists gaps in Kodela as shipped. It cannot list what we have not found yet: if you find one, report a vulnerability.

  • Your host. The OS, its patches, root and Docker group membership.
  • Your identity provider, and whether it requires MFA. Kodela has no native MFA.
  • Bundled third-party tools, such as the terminal, the browser IDE and the vendor agent CLIs, which carry their own advisories.
  • Leaks the audit can see. Items 05 and 06 are detectable in the record; reviewing it is yours.

How this list is kept

The rules we hold it to, including the ones that limit it.

  • Dated, not live. It describes the release as of the date on the receipt.
  • No timelines. “Next” and “planned” are an order of work, not a date.
  • Copy never contradicts it. No page on this site may claim an open item is closed.
  • Not exhaustive. It lists what we know. What ships is recorded in the changelog.

Still want to evaluate it?

Good. Now you know what you are evaluating. See how the layers hold, then run it on your hardware.

The security model Run it on your hardware