Every job runs on its own machine that exists for that job alone.
Isolation
- Each job gets a fresh virtual machine, destroyed when the job ends. Nothing on it carries into another job, yours or anyone else's.
- Each machine has its own network namespace and interface, an encrypted disk, and its own CPU, memory and I/O limits.
- Inbound access to a runner is limited to Sengi's own control plane.
- Sengi treats every job as untrusted: no Sengi API token, cache credential or management access ever reaches a runner.
What stays in GitHub
Your workflows, triggers, secrets, logs and merge decisions stay in GitHub. Sengi never stores:
- your repository secrets, environment variables or workflow outputs;
- your GitHub OAuth token or installation access tokens;
- anything written to the job's disk, which is destroyed with the machine.
Repository access
Install the Sengi GitHub App on Only select repositories to limit what it can see. Sengi runs a repository's jobs only after you connect it to a project, and you can stop new Sengi jobs for a repository at any time from your project's GitHub connections page.
Caches
Build caches are stored per repository so later jobs in that repository can restore them. A cache holds whatever your workflow puts in it, so keep secrets out of cache paths.
Reporting a vulnerability
Email ops@sengi.run rather than opening a public issue.