Security
Security built into the workflow engine
Automation touches your most important systems. Here is how Murmurator keeps that access narrow and visible.
Your AI keys, your data agreements
With your own keys, model calls go straight to your provider under your existing terms. We never train on your prompts or outputs.
Built-in models, clearly scoped
Murmurator AI calls are sent to Anthropic's Claude models hosted on our inference provider, DigitalOcean. Only the prompt a step builds is sent — never your connection credentials. Prefer your own agreements? Use your own keys per model.
Encrypted secrets
Connection credentials and provider keys are encrypted at rest with authenticated encryption. Secrets are never shown again after saving, and workflows refer to connections by name — credentials never appear in definitions or run logs.
Sandboxed code
JavaScript steps run in a fresh V8 isolate per execution with strict time and memory limits, and no network, filesystem, environment or module access.
Isolated workspaces
A workflow that writes code works in a Docker sandbox with its own filesystem, created for one run and deleted when it ends. Paths that resolve outside the workspace are refused, and the only secret that ever reaches it is the one a command needs — a GitHub token for the git command that clones or pushes, a provider key for the coding agent's own model call. Both arrive in an environment file rather than on a command line, and are scrubbed from run logs. A model you host yourself needs no key at all.
Scoped code changes
Cloning and pushing use a GitHub connection's token and obey its allowed repositories. The token reaches git for that one command and is never present while a coding agent is running, so a workflow can only write where you already said it could.
Least-privilege databases
PostgreSQL and MySQL tools run in read-only transactions with statement timeouts and row caps. Writes require an explicit opt-in on the connection.
Verified webhooks
Every connection's webhook deliveries are checked against the provider's own signature, and refused when stale wherever the provider timestamps them. Generic webhooks use unguessable per-workflow URLs.
Network guardrails
Connections can't be pointed at private or internal network addresses, preventing server-side request forgery.
Roles and scoped tokens
Only owners and admins manage connections and models. MCP tokens act as one person in one account, show once, and can be revoked instantly.
Full audit trail
Every definition change is versioned with who made it and from where (assistant, MCP or API). Every run records its inputs, outputs and logs.
Allow-lists
Limit GitHub connections to specific repositories, Slack connections to specific channels, Linear connections to specific teams, HTTP API connections to specific paths and email connections to specific recipients.
Questions or a security report? Contact us.