Containment verification report.

Every VERIFIED chip on this site resolves here. This report records what was tested against the live containment infrastructure, how, and with what result — followed by what this report deliberately does not claim.

Last verified 2026-06-11

Environment live Firecracker microVM · Vercel Sandbox

All checks passed

01

Checks and results

Claim under test · Method · Result

Hardware-isolated microVM PASS Sealed Connected sessions execute inside a Firecracker microVM (via Vercel Sandbox), not a shared process. Full live session run end-to-end on the real microVM infrastructure — created, exercised, destroyed.

Egress: allowlisted host reachable PASS The single allowed destination — the model API — is reachable from inside the VM (positive control). Probe executed inside a live VM; connection to the allowlisted host completed.

Egress: every other host refused PASS Deny-all networking holds for non-allowlisted destinations (negative control). Probes from inside the same live VM to ordinary external hosts; each refused at the network level — before any data could move.

Per-session destroy PASS The VM is destroyed when the session ends; nothing inside it persists between runs. Teardown verified as part of the live session lifecycle.

Skill body never enters the buyer path PASS Buyers receive results, never the skill file. A standing leak-gate check fails loudly if the boundary could be crossed. Automated leak-gate exercised, including an adversarial prompt-injected attempt to make the model emit the body — blocked.

02

What this report does not claim

Not a claim about every production call
The verified environment is built and live-tested. Which executions route through it is an operational setting; we say “verified,” not “every call runs here,” until that's permanently true.
Not a claim about systems outside the session boundary
This report covers the Connected sealed session — VM, network policy, teardown, and the buyer path. Billing, the website, and other surfaces are covered by our broader security practices, not by this report.
Not a substitute for re-testing
Checks are re-run as the infrastructure evolves, and this page carries the date of the most recent pass. A report that never updates is a screenshot, not a property.

03

Questions or findings

Security researchers: if you believe any result above is wrong, write to security@sealed.run — see the disclosure process in Security & data handling. Buyers and sellers with questions about what this means for your data: How containment works covers it in plain language.