RenderNest Security Architecture
How we protect developer infrastructure, eliminate SSRF threats, maintain tenant isolation, and safeguard sensitive data.
Layered SSRF & Network Security
RenderNest processes untrusted URLs using a defense-in-depth security model. Prior to initiating any network connection, URLs are strictly parsed, IPv4/IPv6 addresses are resolved via DNS, and checked against comprehensive RFC-defined private, loopback, multicast, link-local, and cloud metadata ranges (including 169.254.169.254, AWS, GCP, and Azure metadata endpoints). In addition, Chromium network traffic is guarded at runtime via Playwright route interception, guaranteeing that any 301/302 redirects to internal endpoints are instantly dropped before data transmission.
Multi-Tenant Isolation & Zero Cross-Contamination
All resources—including API keys, jobs, request logs, stored artifacts, and webhook endpoints—are strictly partitioned by Workspace ID. API routes enforce database-level tenant ownership checks before processing requests. Attempts to access or enumerate resources belonging to other workspaces return HTTP 404 responses to eliminate identifier probing and tenant leakage.
Cryptographic API Key Architecture
API keys use high-entropy random generation and prefix tagging (wf_live_ / wf_test_). Raw API keys are shown exactly once at creation and are never stored in plaintext. RenderNest stores only SHA-256 hashes of API keys in our database. We provide instant key rotation (generating a replacement while maintaining continuity) and one-click emergency revocation to neutralize compromised credentials.
Ephemeral Isolated Browser Sandboxing
Every rendering and extraction job executes in an isolated, short-lived browser context. Cookies, session storage, local storage, cache, and authentication state are destroyed immediately upon job completion. Workers run with non-root privileges, constrained memory and CPU limits, and strict navigation timeouts to prevent resource exhaustion attacks.
HMAC-SHA256 Signed Artifact Storage
Generated screenshots, PDFs, and documents are stored in scoped object storage. File access requires short-lived signed URLs secured by HMAC-SHA256 tokens and explicit timestamp expirations. Download endpoints strictly prevent directory traversal (blocking relative segments like .. and .), disallow unauthenticated access, and enforce no-store caching headers.
Atomic Quotas & Rate Limiting
To prevent race-condition abuse, credit accounting utilizes conditional atomic database updates (WHERE credit_balance >= required_credits). Simultaneous requests cannot drive balances negative. Requests are throttled using sliding-window rate limiters per workspace, IP, and endpoint tier, returning standard 429 and Retry-After response headers.
Vulnerability Reporting & Coordinated Disclosure
We welcome reports from security researchers and developers. If you believe you have discovered a vulnerability in RenderNest, please report it to our security team.