Last updated: 2026-07-11
Credential boundary
Cloud credentials remain in the official AWS or Alibaba Cloud console. The browser launcher does not collect access keys.
Template integrity
AWS launch links use short-lived signed URLs for catalog-versioned templates. App versions are allowlisted by the launch service. Immutable image digests are used where the catalog declares them.
Abuse controls
AWS launch preparation requires Turnstile, origin validation, strict request validation, rate limits, and an operator circuit breaker. AWS is restricted to us-east-1 until Marketplace AMIs exist in additional regions.
Report a vulnerability
Email support@corenovacloud.com with reproduction steps and impact. Do not include cloud credentials, private keys, or production secrets.