nafnaf Security
Security reviews, built into development.
BugBunny.ai reviews code changes for potential security issues during development. Ongoing automated review is one part of how we improve the security of nafnaf.
Development securityBugBunny.ai BugBunny scan status
Scan coverage, daily scanning and findings status confirmed by Sequester AG on . Reports remain private; this is not a live scan feed.
- Covered
Pull-request scans
BugBunny scans pull requests across the frontend, backend and host agent. Coverage is confirmed by the platform operator.
- Daily scans enabled
Daily domain scans
BugBunny scans nafnaf.ai every day. The scan schedule is confirmed by the platform operator.
- None unresolved
High and critical findings
No unresolved high or critical issues, as confirmed by the platform operator on the date above. This does not mean that no issues have ever been found.
Pull-request security reviews
Reviewing changes as they are proposed helps bring potential vulnerabilities into the development process, before release.
Code changes
Developers propose frontend, backend and host-agent changes through pull requests.
Automated review
BugBunny.ai scans pull-request code for potential security issues and reports findings in the development workflow.
Engineering follow-up
Findings give developers issues to investigate and address. Automated analysis supports engineering review; it does not replace it.
Review scope
Clear coverage matters as much as the security checks themselves.
- Backend API and host agent
- BugBunny pull-request reviews have been verified in the backend repository.
- Frontend
- Sequester AG confirms frontend pull-request review coverage by BugBunny.
Coverage is confirmed by the platform operator. This page is not a live status monitor and does not certify that a passing scan is required to merge.
Platform controls
These protections are implemented by nafnaf. They are separate from BugBunny's code reviews.
API key protection
Inference API keys are generated with cryptographic randomness, stored as hashes, and can be revoked.
Encrypted inference transport
Requests forwarded to the inference server use HTTPS with certificate validation. Upstream redirects are disabled.
Workload limits
Rental containers have CPU, RAM and process limits and use Docker's no-new-privileges setting. Containers are not virtual machines and do not isolate workloads from the host administrator.
Security checks have limits
PR-focused automated reviews are not a full-repository audit, a human security audit, or a certification. They do not guarantee that every vulnerability is found or attest to the security of running infrastructure.
nafnaf operates its hosted inference service. Independent rental providers remain responsible for securing their hardware, and renters for the software they install.
Report a security concern
Found something we should investigate? Send the affected service, a description of the issue, and safe reproduction steps. Do not include passwords, API keys, or other people's data.