Security

Signing in

• Sign in with GitHub, Google or email and password. One account can hold all three (Sign-in methods).
• GitHub and Google sign-ins use PKCE and a one-time state, and only emails the provider has verified are accepted.
• An email already on an account opens that account directly only when the provider runs the mailbox (Gmail, Google Workspace). Otherwise the owner signs in once to connect the new method.
• A password reset signs the account out everywhere.

Tokens

• Tokens are shown once and stored only as hashes. Revoke one and it stops working at once.
• Scopes (read, rent, manage, billing) limit what a token can do, and a token can't create a stronger one.
• Give agents their own token with a spend cap, a longest rental and an expiry.

Money

• Payments run on Stripe; card numbers never reach Arrakis. The balance grows only when Stripe confirms a payment, and each payment is credited once.
• Rentals are prepaid by the hour, and the breaker stops machines the balance can't pay for. You never owe more than you added.
• Stop everything stops all machines at once.

Isolation

Every request acts for the account its token belongs to. Accounts can't see or change each other's machines, payments or tokens.

The machines

Machines run on independent hosts. Keep regulated data off them, and keep your own copy of anything important. Arrakis offers no uptime guarantee during early access.

Rotating a token

1. Create a replacement with only the scopes and limits the job needs.
2. Put it where the job reads it.
3. Revoke the old one.