# Security What the installation guarantees about the embed, and what your side must do. ## What the installation guarantees - **No cookies**: The embed signs in with a token held in the frame’s memory. No cookie is set or read, and an embed token is never accepted from one. Blocking third-party cookies, as Safari does, changes nothing. - **Short, single-use credentials**: A login code works once, within 60 seconds. A session lasts 30 minutes and is renewed by swapping it, for up to 12 hours after the code. Only hashes of keys, codes, sessions and tokens are kept. - **Access ends at once**: Removing a person, changing their role, suspending or deleting an account, and revoking a key end the sessions they affect, open streams included. - **Framed only where you allow**: The embed document names only the page it was opened for, when that page is on your [allowed websites](https://docs.gorunner.io/embed/set-up#allow-your-website) or its customer’s own. Neither list is published: a page learns only whether it is allowed itself. The installation sets this policy itself; a proxy only has to leave it alone. The rest of the installation can’t be framed by another site, and the AI app consent page never. - **Exact origin, exact window**: The frame and the SDK read messages only from each other’s exact origin and window, and never post to `"*"`. Every message is checked before it is read, and none can turn anything on. - **Enforced on the server**: Switches, the app list, roles and the account boundary are checked on every request. Hiding something in the embed is never the protection. A token is held to the same checks. - **Steps stay off your network**: No workflow step ever reaches the cloud metadata service. Your private network, and the installation’s own database and Redis, stay closed unless the operator lists them in `WORKFLOW_PRIVATE_NETWORKS`. Each connection is checked as it is made, so a name that later points elsewhere, or a redirect, can’t get round it. Before v2026.10.4 a step could reach any address the worker could: update before customers build. See [Outbound access](https://docs.gorunner.io/self-host/outbound-access). - **One customer can’t starve another**: Login codes are limited per person, per key and per account, and each account can have its own runs at once. - **A tight frame**: The embed document runs scripts only from the installation, and frames nothing. The SDK sandboxes the frame: scripts, its own origin, forms, popups that leave the sandbox, and downloads. It never navigates your page. It may only write to the clipboard. - **Safe sign-ins**: A connection’s sign-in is tied to the window that started it, with PKCE. An AI app’s sign-in reaches your page with only a request id, is tied to the browser that started it, and its link works once: opened in another browser, it is spent. Its consent page refuses any other site. - **Everything recorded**: Every partner API call leaves a row in the account’s audit log, without its body, except reading an AI app sign-in request. Your staff read it in **Platform › Audit log**, filtered to the organization. There is no partner API for it. ## Your checklist - **Keep the key on your server**: Never in a page, a mobile app, a repository or a log. A key per environment lets you revoke one alone. - **Limit where the key works**: Give the production key **Allowed from**: your servers’ addresses. A leaked key is then useless anywhere else. - **List websites exactly**: Prefer an exact address to a wildcard. Never leave a staging or local address on the production list. A customer’s own domain goes on that customer’s list, through the API. - **Make codes only for the person asking**: Your login-code route trusts your own session. Make a code only for an account the person belongs to, at the role they should have. - **Throttle your login-code route**: GoRunner allows 20 codes a minute for one person. Stop a page that reloads in a loop at your route first. - **Never put a code in an address**: Nor in a log, an error report or analytics. Hand it straight from your server’s answer to `getCode`. - **Give the least role**: `viewer` to look, `operator` to run, `editor` to build. - **Switch off what isn’t needed**: For everyone, one account, or one sign-in. - **Allow the installation in your CSP**: In your page’s Content-Security-Policy: `script-src` for `/embed.js`, `frame-src` for the frame, `connect-src` for the check the SDK makes first. Don’t block `clipboard-write`. - **Keep steps off your network**: Leave `WORKFLOW_PRIVATE_NETWORKS` empty, or list only what customers’ workflows should reach. Never `all`. - **Check every notification**: Its signature, its timestamp, and its `webhook-id`. See [Check a request is genuine](https://docs.gorunner.io/embed/notifications#check-a-request). - **For AI app sign-in**: Do the [four duties](https://docs.gorunner.io/embed/ai-app-sign-in-checks#your-four-duties), every time. - **Keep two platform admins**: So a lost phone never locks your staff out of the Platform. ## If a partner key leaks > **Danger** Revoke it. Rotating isn’t enough: the sessions the old key opened carry on, and the AI apps it signed in keep working. 1. Make a new key on **Platform › Partner keys**, and switch your servers to it. 2. On the leaked key, choose **Revoke…**. Requests with it fail at once, everyone it signed in is signed out, and the AI apps it signed in are disconnected. The dialog says how many. 3. Check each account’s websites ([List an account’s websites](https://docs.gorunner.io/embed/api/websites/list-account-websites)) and its `aiSignIn.address` ([List accounts](https://docs.gorunner.io/embed/api/accounts/list-accounts)). A key can change both, and its changes stay after it is revoked. 4. Read **Platform › Audit log** for what the key did. A changed sign-in address is recorded without its query. **How do I end every AI app at once?** On **Platform › What customers get**, open **Developers** and press **Disconnect all AI apps**, with your two-factor code. People must sign in again to connect. Turning a switch off only pauses them. ## Related - [Set up Embed](https://docs.gorunner.io/embed/set-up): Websites and partner keys · 10 min - [Login codes and sessions](https://docs.gorunner.io/embed/sign-in-and-sessions): How a customer is signed in - [AI app sign-in checks](https://docs.gorunner.io/embed/ai-app-sign-in-checks): Every check, step by step Source: https://docs.gorunner.io/embed/security