Security & privacy

What the browser holds

Very little: a random sessionId in the URL and your login cookies (HttpOnly, never readable by page JavaScript). The browser never sees:

  • the session's secret token (used only between our servers, never in your browser),
  • cloud credentials (kept on our servers, never sent to your browser),
  • your workspace's network address — the editor and port previews load through dg.run itself, so its real location stays hidden.

One deliberate exception: the session owner sees the session IP inside the Own-domain dialog (✎ → Own domain tab) because creating their own A record requires it. That IP becomes public DNS anyway the moment they point a domain at it.

What's public by design

  • Port share links (/p/<token>) — anyone with the link can open that port until the session ends. Tokens are random and unguessable, but treat every shared link as public.
  • Direct links (<port>--<session>.dg.run) and custom addresses (<name>.dg.run, your own domains) — also public, no sign-in. Only the editor itself requires your login.
  • Your dev servers should not rely on link secrecy for real secrets — put proper auth in the app if it handles anything sensitive.

What's private

  • Sessions are owner-only: only you can open, manage, or stop your sessions — requests from anyone else are rejected (admins excepted for support).
  • Stopping a session revokes its share links and drops its custom routing immediately.
  • Workspaces are temporary and wiped when the session ends: nothing carries over to your next session. Your browser also clears leftover editor state, so a new session always starts clean.

Practical advice

  • Don't paste secrets (API keys, tokens) into share-link URLs — URLs end up in logs and chat history.
  • Share the share link (/p/<token>) with strangers rather than direct/custom URLs when you can — it reveals the least (no session id, no port number).
  • Before stopping, git push or download anything that matters — after that, assume it is unrecoverable.
  • Spotted something suspicious? Stop the session (kills all access at once) and email hi@dg.run.