Security & sandbox

Candidate code never touches your machine.

Every review runs in a single-use, isolated sandbox that's destroyed after the report is generated. Here's exactly how we keep your environment — and your candidates' work — safe.

Single-use E2B sandboxes

Every repository runs inside an isolated, single-tenant virtual machine on E2B. The sandbox is destroyed immediately after the report is generated — no shared state, no neighbour escape surface.

No persistent candidate code

Repos are cloned into the sandbox at run time and never stored on CodeVerdict servers afterward. Only the structured report and reviewer-visible logs are retained.

Scoped GitHub tokens

For private repos you provide a fine-grained, read-only token scoped to the specific repository. Tokens are encrypted at rest and used only for the clone step.

Reports encrypted at rest

Generated reports and any uploaded brief PDFs are stored in S3 with SSE-KMS and accessed via signed, short-lived URLs only — never via public buckets.

Data handling

Where does candidate code run?
Inside E2B — sandboxed micro-VMs built specifically for executing untrusted code. Each review gets a fresh VM with no network access to your infrastructure and no inbound ports exposed.
What does CodeVerdict store?
The generated report (scores, findings, requirements mapping, interview questions), reviewer notes you write, and brief PDFs you upload. The candidate's actual source code is not persisted past sandbox tear-down.
Who can see a report?
Only you and teammates you explicitly add. Public share-links are HMAC-signed with a configurable TTL (default 1 hour); they can be revoked at any time by deleting the submission.
What about logging?
We log structured events (review start, finish, errors) for operational reasons. We do not log candidate source code or PII beyond what you explicitly add (candidate name + email).
Compliance posture
CodeVerdict is in beta. Formal certifications (SOC 2 Type II, GDPR DPA) are on the roadmap before the team tier launches. We follow SOC 2 controls today; the audit is what's outstanding.
Found a security issue?

We take responsible disclosure seriously. Email security details directly instead of filing a public GitHub issue.

[email protected]

Ready to try a sandboxed review?

Drop a GitHub URL — the next page shows you the full setup, test, and execution trace inside the sandbox.