Interview Coding Pen — security posture

Base Power Company · security@basepowercompany.com

What this service does, on purpose

This is an internal tool Base Power Company uses to run live technical interviews. A candidate writes code in a browser and we execute it on our servers so both people can see the result. Candidates are members of the public. The code they submit is arbitrary, and we do not attempt to restrict, analyze, or filter it.

Remote code execution by an untrusted party is the function of this service, not a flaw in it. If you have found that you can run arbitrary code here, you have found the product working correctly. We would still rather you read the next section, because the interesting question is not whether you can run code — it is what that code can reach.

The isolation boundary

Base Power production, corporate network, customer data,
cloud credentials, internal services, employee accounts
        ^  no path across this line
The sandbox: an ephemeral per-session Linux VM with
no credentials, no identity, and no data

The execution environment is verified to have:

• No credentials. The process running candidate code has no environment variables beyond a fixed allowlist. No API keys, database URLs, connection strings, or credential files.
• No cloud identity. No instance profile, service account, or OIDC token. Cloud instance metadata is unreachable over IPv4 and IPv6.
• No network egress. Executed code cannot open an outbound connection — not to the internet, not to a Base Power service, not to another sandbox. One documented exception: DNS queries are forwarded to our platform's resolvers. We consider that a low-bandwidth channel with nothing of value to carry, and we would rather state it than claim an absolute that is not quite true.
• Unprivileged execution. Candidate code runs as an ordinary user, not root, and cannot read another process's environment.
• No shared filesystem, and no persistence. A private ephemeral root filesystem per session, destroyed when the session ends or at a hard time-to-live.
• No relationship to anything real. No trust relationship, no network path, and no shared identity with any system holding customer or corporate data.

This service also does not run on any subdomain of basepowercompany.com, so it shares no cookie jar, CSP allowlist, CORS allowlist, or SameSite boundary with our production domain.

Blast radius

The worst realistic outcome of an attacker doing whatever they like inside the sandbox is that they consume some of our CPU for a bounded period and see their own code's output. There is nothing to read, nothing to authenticate as, and nowhere to pivot to.

How we keep this true

These properties are tested, not merely configured. An automated suite submits probe programs through the same public endpoint a candidate uses and asserts that the environment is clean, metadata is unreachable, egress fails, and no credentials are present. It runs on every deploy, and its core checks run again before every interview session.

Out of scope

• Executing arbitrary code in the sandbox. This is the product.
• Reading or writing files inside your own sandbox, exhausting its CPU or memory, or crashing it.
• Reports that a session join link grants access to that session. Join links are the intended credential.
• Automated scanner output with no demonstrated impact.

In scope — please tell us

• Escaping the sandbox to the host, the orchestrator, or another session.
• Any credential, token, or environment variable present inside the sandbox.
• Any network egress from the sandbox beyond the documented DNS exception.
• Reaching cloud instance metadata from the sandbox.
• Reading another session's code, output, or join link.
• Obtaining interviewer privileges without an authenticated interviewer session — including anything that lets a client assert its own role.
• Creating a session without an authenticated interviewer.
• Anything that touches Base Power Company's production systems, corporate network, customer data, or employee accounts by any path originating here.
• Any DNS record under basepowercompany.com pointing at this system. There should be none.

Reporting

Email security@basepowercompany.com with enough detail to reproduce. We will acknowledge within two business days. We do not run a paid bounty for this asset, and given the scope above we expect few valid findings. We will credit reporters who want credit.

security.txt