Security and fair use

Envbay is intended for development and staging (test versions before launch). Each instance (your development server) runs separately from the others.

In short

• Your instance is separated from other customers.
• Your projects are private by default.
• Please no port scans (probing other people’s servers) and no attacks on others.
• A guard (an automatic checking program) locks your instance on port scans and connection floods.
• If your instance is locked, your data is kept.
• The terms and conditions forbid mass emails and crypto mining (computing for money).

The terms and conditions are binding.

Your instance has been locked

You see this when your instance is locked:

• Your projects are stopped.
• After logging in to your instance, you see a lock page.
• The actions on the service page (the page of your instance in my.envbay.com) are locked.

This is how you get back in:

1. Log in at my.envbay.com.
2. Write us a ticket (a message to support).
3. Write what you changed last.
4. Wait until we have checked the case.
5. After approval, restart your projects.

A lock can also be triggered by an open invoice. Then pay the invoice.

Report a security vulnerability

Have you found a security vulnerability at Envbay? Write to security@envbay.com.

1. Describe where the issue is (address, page or function) and what it would allow.
2. Include how we can reproduce it (steps, screenshot). Do not access third-party data and do not change anything.
3. You will get a reply with an assessment within three working days.
4. We fix the issue and let you know. Please do not publish anything before it is closed (at the latest after 90 days).

We do not pay bounties, but we credit you as the finder on request.

If something does not work

You are not sure whether your instance is locked? Write us a ticket. The steps are in the Help chapter.

Isolation

Each instance runs in its own sealed-off container, separated from all other customers. Each customer has a firewall of their own, and there is another layer on the host. The project containers of your own instance build on top of this.

Direction	Rule
Incoming	only 80, 443 and the SSH ports of the instances
Outgoing to the internet	allowed
Outgoing to other customers, Envbay systems, private networks	largely blocked (DNS and package cache remain reachable)
Outgoing mail ports 25, 465 and 587	blocked (catch mails in tests via Mailpit)
New outgoing connections	at most 50 per second, short peaks up to 200

Automatic lock

A guard checks the instances every minute. It counts firewall drops and hits of the connection throttle. If an instance reaches 50 hits in 5 minutes, as can happen with port scans and connection floods, it locks the instance automatically and notifies Envbay.

This is what happens:

• A snapshot of the instance is saved (@guard-<time>); your data is kept.
• The Fleet Manager locks the instance with a message in two languages. Envoryx stops all projects.
• The instance is cut off from the network: incoming only port 443, outgoing only name resolution and the connection to the Fleet Manager. Computing power is throttled. The container itself keeps running; it is stopped only if the isolation does not take effect.
• Envbay reviews the incident and releases the instance. There is no self-release. There is no commitment on how long the review takes.

What you see during a lock:

Where	Effect
Login page of the instance	reachable
Interface after login	lock page with the message from Envbay (German and English)
Project addresses	response “is stopped” (HTTP 503)
API, MCP, SSH, SFTP	rejected (API: HTTP 403, code suspended)
Service page in my.envbay.com	actions are rejected, with a note about a ticket

Anyone who is not logged in does not see the lock message. After approval, your projects do not start on their own; start them in Envoryx. Right after approval, the guard does not count again for 5 minutes.

What you can do

Open a ticket with the name of your instance. Describe what was changed last, and update affected projects (dependencies, plugins, passwords).

A lock due to an overdue invoice has the same effect: projects stopped, data kept. Once payment has been received, the lock is lifted; see Ordering and account.

Sustained load

If an instance keeps the CPU almost fully loaded for hours (on average above 90% over two hours), the system reports this to Envbay. Nothing is locked automatically. Envbay reviews the report and may contact you. Sustained load is not meant for development and staging; the terms and conditions govern the consequences.

Malware scan

The files of your projects are regularly checked for known malware: Monday to Saturday at 04:30 the changed files, on Sundays at 03:00 all files. Files over 50 MB as well as directories such as node_modules, vendor and .git are excluded. A finding is sent to Envbay as a report; the scan does not lock or delete anything itself. Envbay reviews the finding (false alarms are possible) and may then ask you to clean up the files.

Your responsibility for your own projects

Envoryx controls Docker on your instance and uses the Docker socket for this. Anyone with Docker access in Envoryx has root rights in their own instance, but not beyond it. You are responsible for the security of your projects yourself:

• Assign roles sparingly, use two-factor login, keep passwords and API tokens secret.
• Store secrets only as secrets, never in the repository (see Set up a project).
• Debugger ports without login (Delve, rdbg, JDWP) belong only in the SSH tunnel.
• Keep shares short-lived (see Projects and addresses).
• Keep applications and dependencies up to date.

Support access

Envbay opens your interface only if the admins of your instance allow it. Every login is recorded in the audit log, see Getting started.

Fair use and terms and conditions

Use is permitted for the development and staging of your own projects. Not permitted are in particular attacks on third parties, mass sending of emails, crypto mining, scanning foreign systems, malware and attempts to bypass the isolation. If there is a specific suspicion, Envbay may stop the instance; in case of repetition or missing cleanup, the contract can be terminated. Deadlines and details are governed by the terms and conditions.

Reporting security vulnerabilities

If you have found a security vulnerability at Envbay, write to security@envbay.com (forwarded to the operator team, reply within three working days, coordinated disclosure after 90 days at the latest, no bounty programme). Please describe the location and impact without retrieving third-party data or disrupting operations. The contact is also listed in the file security.txt on envbay.com.