Cloud boundary
The Laravel cloud stores users, workspaces, projects, run plans, redacted logs, artifacts, and reports. It does not clone repositories, execute project commands, or receive a Docker socket.
Security by architecture
Untrusted execution stays outside the control plane.
PatchProof separates orchestration from repository execution, uses scoped credentials at every boundary, and keeps deterministic evidence reviewable without exposing raw secrets.
Cloud plans and records.
Self-hosted runners execute.Four explicit boundaries
Authority is separated before a run starts.
Runner boundary
Self-hosted runners clone and execute code in per-run workspaces with time limits, bounded logs, explicit capabilities, and cleanup restricted to directories PatchProof created.
Credential boundary
Operator, invitation, runner, and per-job tokens are separate. Long-lived credentials and invitation tokens are stored only as SHA-256 hashes; plaintext is displayed only when first issued.
Tenant boundary
Session and API access require a verified operator, current workspace, role authorization, and resource ownership checks. Cross-workspace identifiers return not found.
Trust boundary
Coordination in the cloud. Execution on your runner.
PatchProof keeps untrusted repository work outside the control plane while preserving a shared, reviewable proof.
-
01
PatchProof Cloud
Plans runs, matches runner capabilities, stores structured evidence with redacted logs, and enforces workspace access.
- No repository execution
- No Docker socket
- Scoped orchestration tokens
-
02
Self-hosted runner
Claims the job, checks out authorized source, executes bounded commands, and redacts output.
- Per-run workspace
- Bounded time and logs
- Customer-controlled network
-
03
Reviewable proof
Separates execution, risk, and verdict so the merge decision points back to concrete evidence.
- Deterministic findings
- Redacted logs, bounded artifacts
- Commit and policy provenance
Security controls
Defence in depth around identity, jobs, and evidence.
Operator and workspace access
- Verified email and throttled password recovery
- Owner, Admin, Member, and Viewer permissions
- Expiring, revocable workspace invitations
- CSRF protection and secure session cookies
- Tenant ownership checks with non-disclosing failures
Runner and job access
- Separate operator, registration, runner, and job credentials
- Hashed long-lived credentials
- Short-lived per-run job tokens
- Runner label and capacity matching
- Monotonic step and run lifecycle validation
Presentation and transport
- Security headers, trusted hosts, and HTTPS enforcement
- Token-aware API and runner rate limits
- Pre-upload and server-side log redaction
- Bounded user-facing metadata
- No operator credential shared with runner code
Evidence handling
- Artifact path, size, content, and retention controls
- Symlink and dependency-directory exclusions
- Capped logs and report projections
- Separate execution, risk, and verdict state
- API health and database readiness boundaries