Security
Banana Peel is SOC 2 Type II. Routing quality is always subject to custody: secrets are never written into routing traces, vault material is AES-256-GCM, runners are gated by trust tiers, and artifacts default to a 7-day retention window.
The public hub is /security. This page is the docs index for the same model.
SSRF and runner egress
Every caller-controlled URL is checked at submit time and again on every navigation or redirect: scheme, hostname, and the resolved A/AAAA addresses. Private, link-local, loopback, and cloud-metadata targets (including names like nip.io that resolve there) are rejected with a consistent client error before a runner is asked to visit them.
Runners Banana Peel launches (Playwright, Puppeteer, and other OSS browsers on our compute) also send traffic through a shared egress guard so a later redirect or agent-driven goto cannot reach internal space. Third-party hosted browsers (Steel, Browserbase, Kernel, Browser Use cloud, Deck, and similar) run inside the vendor network — we do not install a firewall in their VPC. Their egress isolation is a supply-chain consideration and is unverified. We still refuse private URLs before sending them.
Architecture
Client → API (TLS) → custody filter on the runner candidate set → vault decrypt (only if the policy is satisfiable) → injection onto an allowlisted runner → redacted routing trace. A policy that empties the candidate set fails with 409 custody_unsatisfiable before decrypt, dispatch, or billing.