Security and trust
Your code runs only in an isolated sandbox with the network off for checks. No secret enters it. Only Nemotron on Token Factory reads code, and nothing reaches your default branch without your merge.
The sandbox
A private repository's installs and checks run on Cloudflare Containers: one Durable Object drives one container, and each side of a run gets its own. A public repository's, and every dry run's, run on Token Factory Sandboxes, a microVM per command, with no network interface during the checks.
On Cloudflare Containers:
| Rule | How |
|---|---|
| No direct internet | Containers start with enableInternet: false. All HTTP and HTTPS goes through Teire's egress handler |
| Install: registries only | GET and HEAD over HTTPS to 25 hosts: npm and Yarn, PyPI, Maven Central and Google's mirror, Gradle, the Go proxy, crates.io and the Rust toolchain, RubyGems, Adoptium, and GitHub with its release assets |
| Checks: nothing | Every request is answered 403 and recorded with its host, method and path. Denied hosts appear in the PR |
| No secrets inside | The repository arrives as a tarball the egress handler fetches outside the container, adding the GitHub token itself. The token is dropped after the fetch. Model keys never enter |
| No install scripts | npm, pnpm, Yarn v1 and Bun install with --ignore-scripts, Yarn Berry with --mode=skip-build |
| One token per sandbox | Each sandbox needs its own signed token (HMAC-SHA256). The worker signs it for 15 minutes; the service refuses anything valid for over 2 hours |
| Bounded | Each job has a 60-minute ceiling, each command's output is capped, and an idle container stops after 15 minutes |
| Nothing left behind | Tearing a sandbox down deletes its container and all its stored state |
The worker never runs your repository's code. It reads packages with static tools: TypeScript declarations, griffe, apidiff, Prism, japicmp on jars, and ast-grep. Tarballs are integrity-checked and unpacked by Teire's own extractor, which refuses links and .. paths.
The package cache
On Cloudflare Containers, a repository can keep its package manager's download cache between runs, saved to R2 after the baseline installs and restored before the next run's installs. It is keyed by the repository, never by a lockfile: the worker looks up every restore by the run's own repository, so one repository's cache can never reach another's checks. Only the download directory is saved (npm's _cacache, pip's and uv's caches, Go's module download cache, Cargo's registry cache, Maven's repository, Gradle's files cache), never built output or your code. The sandbox Worker seals each record it saves and restores only records it sealed itself, under the name the worker gave it, so a record handed in from anywhere else is refused. A root that installs from its own registry (an .npmrc or .yarnrc.yml registry or token, a pip index, a Cargo registry, a Gemfile source, a Maven settings.xml or repository) is never cached, so a private registry's packages never reach the bucket. A root keeps its two newest caches; uninstalling the app, or removing a repository from it, deletes its records, and the bucket expires objects after 30 days. The receipt says whether a run restored a cache, how long it took, and which lockfile it was saved from, and a restore that fails says so instead of reading as "no cache". It is off until R2 is enabled for the deployment.
The dependency updater
Manifest and lockfile changes are moving to dependabot-core's updater (How Teire updates dependency files). It runs on Teire's own server, not in the verification sandbox:
- in a separate Docker daemon whose containers run under gVisor;
- on a network with no route out, behind Dependabot's proxy and a host firewall that blocks Teire's apps, its database, cloud metadata and every host port;
- with a token that can only read the one repository, held by the proxy, never by the updater;
- with images pinned by digest, whose build attestations are checked before use;
- one job at a time.
The threat model lists each control and the probe that proves it.
The agent
The model is handed file contents, documentation, check output and provider pages as data, never as instructions. Code limits what it can do:
- It edits only the files the change reaches and the files your check output names.
- It never edits manifests, lockfiles,
tsconfig, build config, CI,.envfiles or credentials. - It can't read
.env*,.git/,node_modules/or key files. - It must not delete, skip or weaken tests, or add new casts,
anyor type-ignore comments. The review checks the final diff for exactly these.
Provider data
A provider's change is acted on only when its quote is found word for word in the page Teire fetched from the provider's own domain. See the quote gate. Items whose quote fails are dropped; records that fail the final checks are kept as unconfirmed and never applied.
On GitHub
| Permission | Access | Why |
|---|---|---|
| Contents | write | Read the code and dependency files; push one branch per fix (teire/…). Never the default branch |
| Pull requests | write | Open and update fix PRs, and the Configure Teire onboarding PR |
| Issues | write | Keep the Teire Dashboard issue, open needs-a-human issues, and answer @teire commands |
| Checks | write | Publish the Teire check run with an annotation on every line a change reaches |
| Actions | read | Read your CI's logs when it fails on a Teire PR, for one repair attempt |
| Metadata | read | Repository names and default branches; GitHub requires it for every app |
| Email addresses | read | Your account's email when you sign in with GitHub, to name your account; never emailed |
Teire never merges and never pushes to your default branch. Commands and dashboard actions need write access to the repository.
Where your code goes
- Models. Only NVIDIA Nemotron on Nebius Token Factory reads code.
- Search. Tavily receives search queries that name a provider, such as "Groq API deprecations…", never code.
- Storage. A scan downloads the repository at one commit and deletes it when the scan ends. Teire keeps the findings (file, line and the matching line), the diffs it proposes, run logs, receipts, and the tail of each sandbox command's output.
Token Factory Sandboxes
Public repositories and dry runs are verified on Nebius Token Factory Sandboxes, microVMs Teire builds its own images in. Private repositories stay on Cloudflare Containers.
Contributing to the catalog
Add a provider Teire can read, or a change it missed, through a pull request. CI checks it against the same schema Teire uses, and a merged record is live on the next deploy.