zeroterm.
Meet ZeroTerm Get started
ZeroTerm

Security

ZeroTerm controls real servers, so it is built to do as little as necessary and to verify every step.

The agent on your machine

  • Connects outward over HTTPS only. You never open an inbound port for ZeroTerm.
  • Enrolls with a single-use token that expires after 10 minutes, then uses its own revocable credential.
  • Manages only containers it created, recorded in manifests signed with its credential. It never adopts other containers or host processes.
  • Runs services without Linux capabilities, with the memory, swap, CPU, disk and process limits you set, and publishes ports on the loopback interface unless you mark a port public.
  • Releases are published with SHA-256 checksums that the installer verifies.

The control plane

  • Every operation is authorised against the owner, operator or viewer role on that machine or service, at request time and again when the agent picks it up.
  • Queued operations, service variables, Git tokens, webhook secrets, backup storage keys and chat bot tokens are encrypted with AES-256-GCM. API tokens are stored only as SHA-256 hashes.
  • No passwords: sign-in uses Google, GitHub or single-use email links that expire after 10 minutes, with optional two-factor authentication (TOTP) and single-use recovery codes.
  • SSH sessions require a verified host fingerprint; SSH passwords stay in memory and are never stored.
  • File changes check a revision so concurrent edits are not overwritten; uploads and archives are verified with SHA-256 and never replace existing files.
  • AI changes follow manual approval or the explicit automatic approval settings you enable on Pro; file changes are preceded by a backup.
  • Requests are rate limited and outbound webhooks cannot reach private networks.

Reporting a vulnerability

Email [email protected] with the subject "Security report", steps to reproduce and the impact. Please do not access other users' data, disrupt the service or disclose the issue publicly before we have fixed it.

We acknowledge reports within 3 working days and keep you informed. We will not take legal action against good-faith research that follows these rules. Our contact is also published in security.txt.