Security at LemonLime.

One sandbox per cloud thread

Every cloud thread runs in its own sandbox, made for that thread and no other, on its own git branch. The agent has full admin rights inside it, so it can install what the task needs, and its files, installs and running processes belong to that thread alone.

• A sandbox pauses after 5 idle minutes. One whose runner stops reporting for 10 minutes is paused too.
• On your own computer, each local thread works in its own git worktree on its own branch, so your checkout and uncommitted work stay exactly as they were.
• Locally, agents edit files freely but ask before running any command. You see the exact command and choose Allow or Don't allow.

Short-lived, narrow access

• GitHub. You install our GitHub App only on the repositories you choose. Each sandbox gets a token for its own thread's repository and nothing else, allowed to push code and open pull requests, and it expires after an hour. Git tokens are only ever sent to GitHub.
• Apps. The desktop app and dashboard get a 15-minute token to talk to a thread, and an open connection ends when its token does. Remove someone from a workspace and they're cut off within 15 minutes.
• Inside the sandbox. The runner's own tokens last 10 minutes at most, and the agent never gets the thread's secret. Its tools use a separate key that only their own routes accept.

Secrets

Add keys like NPM_TOKEN under Settings, in a form made for it, never in the chat. Each one is encrypted the moment it arrives with AES-256-GCM, tied to your workspace and the secret's name, and the API only ever hands back names, never values.

• New cloud sandboxes get your secrets as environment variables. Their values are replaced with [secret NAME] before anything reaches the thread's history, your apps or our servers.
• When you sign an agent in to your model account inside a sandbox, the sign-in is saved encrypted so your next sandboxes start signed in. We only accept it within 30 minutes of someone in your workspace asking to sign in, and only the files that agent needs.
• The desktop app keeps its own sign-in in your system's keychain: Keychain on macOS, Credential Manager on Windows, the secret service on Linux.

Your AI account stays yours

Agents talk to the model provider directly, with your own Claude or ChatGPT plan or your own API key. LemonLime never proxies, meters or bills model calls, so your model usage never passes through us and we never resell or mark up tokens.

What we keep

For the hosted service at app.lemonlime.dev:

• Your account: your email address, and your GitHub username if you sign in with GitHub or connect the GitHub App.
• Cloud threads: the conversation history, the repository you chose and the thread's branch, so you can read a thread after its sandbox pauses.
• Secrets and agent sign-ins: encrypted, as above.
• Usage: when sandboxes start and stop, and their size, to count credits. To spot abuse, the runner also reports how busy a sandbox's processor is and the name of its busiest program.
• Billing: payments go through Stripe. We keep your plan and Stripe customer ID, and never see your card number.

Local threads stay on your computer: we don't receive their history or code. If you turn on phone access for a computer (it's off by default), we keep a short list of its threads (title, agent, folder name, branch and status, never paths or history), and the conversation you open on your phone is relayed through our servers.

We don't sell your data, and we don't use your code, prompts or threads to train AI models. The details are in our privacy policy.

Guard rails

• Sign-in. One-time 6-digit codes by email, valid for 10 minutes, stored hashed, and dead after 5 wrong tries. Requests are rate limited per IP address and per email address. GitHub sign-in works too.
• Command guard. In cloud sandboxes the runner blocks the few commands that destroy a computer rather than a project: deleting the root or home folder, wiping a disk, fork bombs, and deleting a whole GitHub repository.
• Abuse. We watch hosted sandboxes for crypto miners, and stop the ones we catch.

Open source, so you can check

The desktop app, the runner inside every sandbox and the dashboard are MIT-licensed and public on GitHub. Anyone can read how tokens are signed, how secrets are encrypted and what the runner sends home. The hosted service runs that same dashboard, with a private plugin for billing and usage limits.

Every change to the public repository is checked by its tests and by a scan for leaked secrets.

Run it on your own servers

Self-hosting is free and unlimited. Run LemonLime on your own Cloudflare account, on any Node server with SQLite, or with one Docker Compose command on Ubuntu. Your code and data then stay on infrastructure you control.

The Docker Compose setup firewalls its sandboxes: they can reach the internet, and not each other, the host, your local network or the cloud metadata service. Self-hosting guide

Our addresses

LemonLime only lives at these addresses. If something else claims to be us, it isn't.

Report a vulnerability

Please report it privately, not in a public issue: use the Report a vulnerability button on our GitHub repository's Security tab. Tell us what you found, how to reproduce it and what an attacker could do with it.

You'll get an acknowledgement within 3 working days and a plan within 10. We'll credit you in the release notes, unless you'd rather we didn't. Read the security policy