Get Started

Security Model

Runny stores and serves script bytes. The client fetches. The local runtime executes. Private access is checked before bytes are returned.

Trust boundary

  • Runny stores script content and serves it over HTTPS.
  • Runny does not execute hosted scripts.
  • The client fetches /r/{slug}.
  • The client’s local runtime executes the bytes.
  • Private access is checked before raw content is returned.
  • Revoke takes effect on the next fetch.

How a fetch runs

Client fetch and local execution The client sends HTTPS to Runny. Runny returns raw script bytes. The local runtime executes them outside Runny. Client HTTPS Runny raw bytes Local runtime executes outside Runny

Private access

Tokens belong in Authorization: Bearer. Query-string tokens are accepted on /r/ but they leak. A session cookie never substitutes for a fetch token.

Scanning

When scanning is enabled, create and body/runtime updates are scanned for every visibility, not only public. A held or quarantined script returns HTTP 200 with a stub so a piped curl still shows the stop message. See Script scanning.

Rate limits

Raw fetches: 120 per minute per IP, then 429 and rate limited. API: 60 per minute per IP, then JSON {"error":"rate limited"}. Abuse reports are limited separately. Exact module rules are not published.

Logs

Fetch logs store hashed IP addresses and user-agents, not raw addresses. Script bodies live apart from listing metadata. Authenticator secrets are encrypted with the application key. Details are in the Privacy Policy.

Restore revision