Security Model

What Sylo protects against

Threat	How
Agent leaking API keys	Keys never enter the sandbox — injected on the wire
Agent calling unauthorized APIs	Policy enforcement blocks disallowed domains/methods/paths
Agent exfiltrating data	Default-deny policies restrict outbound access
Credential theft at rest	AES-256-GCM encryption in the database
Session hijacking	Per-sandbox tokens with TTL, revocable instantly
PII in API requests	Pattern-based detection with redact/block actions

What Sylo does NOT protect against

Threat	Why
Agent with root access	Root can tear down iptables and bypass the proxy
Sandbox escape	That’s the sandbox provider’s job (E2B, Docker isolation)
Compromised gateway	If the gateway is compromised, credentials are exposed

Sandbox requirements

The agent must not have root access. With root, the agent can iptables -F to tear down proxy rules and access the internet directly.

Provider	Root access	Action needed
E2B	Non-root by default	None
Docker	Root by default	Add USER to Dockerfile
Modal	gVisor (virtualized root)	Use proxy mode

Credential encryption

Credentials are encrypted at rest using AES-256-GCM:

Plaintext: "Bearer sk-proj-abc123..."
Stored as: "ENCRYPTED:<base64(nonce + ciphertext + tag)>"

The encryption key is a 64-character hex string (32 bytes). Credentials are decrypted only in memory during request processing.

Network architecture

                    ┌──────────────────────────────┐
                    │        Sylo Gateway            │
                    │                                │
Sandbox ──TLS──▶  Tunnel Server (:8443)             │
                    │    │                           │
                    │    ▼                           │
                    │  mitmproxy (:8080)              │
                    │    ├── reads session from Redis │
                    │    ├── injects credentials      │
                    │    ├── enforces policies        │
                    │    └── writes audit to Postgres │
                    │         │                      │
                    │         ▼                      │
                    │    Real API                     │
                    └──────────────────────────────┘

Reporting vulnerabilities

If you find a security vulnerability, please report it via GitHub Security Advisories.