Security boundaries you can verify
Vlnry requires explicit target authorization, keeps repository access read-only, isolates every run, encrypts account-scoped provider credentials, and keeps secrets out of queues, reports, logs, and telemetry.
How sensitive data stays bounded
A run cannot start until the account confirms ownership or explicit permission and accepts the non-production testing gate.
The GitHub App receives contents and metadata read access for selected repositories and is never used as a login provider.
Each real run executes inside a bounded throwaway environment with resource and wall-clock limits.
Model credentials are encrypted with AES-256-GCM, never readable after save, and resolved only for the owning account and run.
Ownership checks return 404 for another account's resources so their existence is not disclosed.
Provider credentials, prompts, responses, repository content, and target credentials are excluded from queues, reports, logs, fixtures, and telemetry.