Security and trust.

This page describes what the product does today, as built, not a policy. Where Prized does not do something yet, it says so.

Reaching a box

Your machine reaches a box through a WireGuard tunnel the CLI builds inside its own process, and SSH runs inside that tunnel. Nothing else on the box is reachable from the internet.

• The tunnel. prized login generates a WireGuard key for this install (~/.config/prized/wg.key, mode 0600) and an ed25519 SSH identity (id_prized); only the public halves are ever sent to Prized. The CLI runs wireguard-go with a userspace network stack: no TUN device, no root, no change to your machine's network settings.
• What the box exposes. Every box has a public IP and is provisioned with two inbound rules, shared by the whole fleet: UDP 51820 (WireGuard) and TCP 443 (WireGuard packets carried over a WebSocket, for networks that block UDP). There is no inbound port 22. The TLS on port 443 uses a self-signed certificate that clients do not verify; WireGuard inside it is the security layer.
• SSH inside the tunnel. The box's sshd presents a host certificate signed by the Prized host CA (valid 90 days), and your machine trusts that CA through one @cert-authority line in ~/.config/prized/known_hosts, so there is no trust-on-first-use prompt and nothing to pin. You authenticate with a user certificate signed by the Prized user CA, minted for your token and box on each connection and valid for 15 minutes. Prized sets no password on the box account.
• Two CAs, two homes. The user CA private key lives with the control-plane API, the host CA private key with the reconciler worker only. Neither is on any box or on your machine.
• The box agent. prized-agent serves the CLI on port 7377 bound to the box's tunnel address only, and refuses to bind a wildcard; the ports that are never mirrored are listed under Ports.

Other ways in

Identity and access

You sign in with Google or GitHub; a Prized account has no password of its own, and a verified email address is required.

Boxes belong to a workspace, not to a person. Every member can connect to, run commands on, and delete every box in the workspace; only the owner changes billing, the claimed domain, the invite link, membership, and the data-retention switch. See Workspaces.

Credentials Prized issues

Only a signed-in dashboard session can mint a CLI token, a ticket, or a phone password (the browser step of prized login is that session), so a leaked CLI token cannot mint more credentials; removing a member revokes everything they created (Workspaces).

Staff

Prized staff are the Google Workspace accounts on prized.dev, plus a short allowlist kept in source control. On your account, staff can:

• View fleet pages: boxes by state and by owner email, agent and CLI versions, command counts and failure causes, and, per CLI token, the member's email, the token's name, its CLI version, and when it was last used. No box contents, terminal output, or file data.
• Set or revoke an internal credit grant, promise a credit to an email address, sign a startup-plan link, and reset your onboarding tour.
• Purge an account: terminate its boxes, delete its Stripe customer, and delete every row.

Nothing in the product gives staff a terminal, a command, a file read, or a device key on your box: tickets and phone passwords are minted only by a member's own session for a box in their own workspace, and there is no impersonation. Prized does operate the AWS account and the database, so an operator with those credentials could reach a box's disk or a snapshot outside the product; no customer-visible log records that today.

Credentials and secrets

Your agents' sign-ins travel from your machine to the box over SSH and never touch the control plane. Secrets you store with Prized are encrypted, write-only, and swapped into requests on the box.

• Handoff. Sign-ins go over the SSH session's stdin into 0600 files on the box, as described in Credentials; no API route accepts an agent sign-in, and CLI telemetry carries command names only.
• Secrets and connectors. How a stored secret works (a placeholder in the box's environment, the real value swapped into request headers for the hosts you allowlisted) is in Secrets for agents. Two facts to add: the value is encrypted with AES-256-GCM under a key held by the control plane, and the box's broker (prized-secretsd) does the swap through a per-box CA it installs in the box's trust store, so it can open and re-seal TLS to those hosts only, re-dialling each over verified TLS; plain HTTP to those hosts is refused. Connectors are presets over the same broker.
• What the broker does not protect against. The boundary is your box account: anything running as your user can send a request that spends a mounted secret, and root on your box can read anything on it, the broker included. The broker keeps values out of env files, shell history, logs, and pasted placeholders; it is not a defense against the box itself.
• Environment secret files are encrypted the same way and fetched by the root mini agent over the box's authenticated channel, never through launch user-data. See Environments.
• Restricted boxes receive no credentials through any of these channels. See Safe for third parties.

What launch user-data contains

A box's first-boot script is readable on the box by root through the instance metadata service, which requires IMDSv2 with a hop limit of 1 and is blocked by a firewall rule for every other user. It carries the box id and control-plane URL, the box's own agent token (Prized stores only its hash, and rotates it to an unrecoverable value when the box is terminated), the SSH host private key and certificate, the user CA public key, your non-secret environment variables, the repos to clone, and the setup script. The WireGuard private key is generated on the box and never leaves it.

Data at rest and in flight

• Disks and snapshots. Every root volume is created encrypted under the account's default EBS key for that region; snapshots inherit that encryption, a cross-region copy is re-encrypted under the target region's key, and there is no customer-managed key option. Boxes run in us-west-2 (Oregon) or us-west-1 (Northern California), a snapshot stays in its box's region unless you move the box, and what a delete keeps is in Data retention. Prized also keeps daily backup snapshots of box disks for disaster recovery, the newest 7 per disk; they are not visible to you, and zero data retention does not turn them off.
• The control-plane database is Postgres, hosted by Neon. A box row holds identifiers, size and region, state, the agent token's hash, tunnel addresses, last vitals, and settings; secrets and secret files are stored only as ciphertext.
• Backups. A nightly pg_dump goes to S3 (server-side encrypted, expiring after 35 days) and is restored into a scratch database in the same run to prove it works; Neon's own point-in-time recovery is the first resort.
• In flight. prized.dev (Vercel), api.prized.dev (Fly.io), and the terminal edge (Fly.io) serve HTTPS only, and the CLI refuses a plain-http control-plane URL anywhere but loopback. prized.dev carries a two-year HSTS header (set by Vercel); api.prized.dev does not send one.
• Telemetry. What the CLI and the site record, and the switches, are in Privacy. From a running box, the heartbeat every 15 seconds carries CPU, memory, and disk percentages, seconds idle, the listening port numbers (kept as a count), versions, the public IP, and the WireGuard public key, plus 30-second metric rows: CPU and load, memory and swap, network receive and transmit rates per interface, disk read and write rates and utilization, and mount points with their sizes. Every 60 seconds the monitor also sends up to 20 processes (the top 10 by CPU and the top 10 by memory: user, name, and the first 120 characters of the command line) and the listening ports with their process names; no file names, file contents, terminal output, or shell history leave the box, and how long each is kept is in Telemetry retention windows.
• Error reporting. Sentry runs on the server side only (API, worker, and the site's server runtime) with PII sending off: an event is a stack trace with service, release, and route-template tags, scrubbed for token and key shapes, and never a request body, header, cookie, IP, or user id. Browser errors go to PostHog as described under Privacy; the CLI and the box agent have no crash reporting.
• Logs. The API, worker, and terminal edge log to Fly.io. No request bodies, Authorization headers, tickets, or keys are logged; the terminal edge logs each session's open and close with the channel, box, and remote address. Log retention is the platform default, which Prized has not configured.

On the box

• Processes. Root runs prized-secretsd, the mini agent, sshd, and the WireGuard and WebSocket-fallback services; prized-agent runs as your login user. The listeners are 7377 on the tunnel address, 7379 on loopback, and 51820 and 443 on the public IP. The full table is under Machines.
• Your account has passwordless sudo (Machines), so anything running as you can become root. sshd accepts the Prized user CA, registered device keys, and any key you put in ~/.ssh/authorized_keys.
• Codex's own sandbox works: the image installs bubblewrap and an AppArmor profile that grants user namespaces to /usr/bin/bwrap only.

What the control plane can tell a box. The heartbeat answer carries at most the agent version to update to, a pause acknowledgement, and the device-key file; separate channels deliver environment variables and secret files, secret values, and the WireGuard peer list. No route carries a shell command to the box's agents. Two facts to know:

• The mini agent, which runs as root, refreshes its own source from the control plane every 6 hours with only a syntax check, so a control-plane compromise could replace it. The Go agent, the secrets broker, the installer, and the systemd unit are minisign-signed and sha256-checked before they run.
• A CLI token in your workspace can run any command on any box in it through the exec API, read and write files, start prompt runs, and open a desktop; with sudo that is the whole machine. The box's event history records lifecycle transitions only (create, pause, resume, delete, snapshot, region move, billing holds) with the kind of actor, so command runs, file reads, terminal sessions, and desktop opens are not recorded anywhere you can see today. Certificate mints are recorded internally (which workspace, which box, when) but have no customer surface yet.

Isolation. Every box you can buy is its own EC2 instance with its own kernel and encrypted disk, and no IAM role is attached to it.

What the control plane cannot see

• Your agents' sign-in tokens. They travel over the SSH session's stdin; no route accepts one.
• Secret values after you save them. Encrypted under the master key; decrypted only in the response to the owning box's broker; no read-back route.
• Your private keys. The WireGuard and SSH private keys on your machine never leave it; the box's WireGuard private key is generated on the box.

Sub-processors

The services that hold or carry your data, as wired in the product's code and deploy configuration.

Certifications and disclosure

Certifications: none today. Prized holds no SOC 2, ISO 27001, or HIPAA attestation and offers no data processing agreement.

To report a vulnerability, email team@prized.dev with the steps to reproduce; we read every report and would rather hear about a problem before it is published. There is no bug bounty.