Security

Every job runs in a virtual machine booted from a signed image and destroyed when the job ends. The runner inside it runs as a standard user. The host agent has no access to your keychain or home folder beyond its own directory, sends heartbeats and job metadata only, and never sees job content.

A job's VM reaches the internet and nothing else: not your private network, not the host's own services, not cloud metadata addresses. This is the default, --vm-network isolated.

Every machine is trusted or burst, set only by a person at that machine. A job that uses secrets other than GITHUB_TOKEN, sets an environment, requests id-token: write or inherits secrets is handed only to a trusted machine; the control plane checks the workflow when it registers the runner. A machine without full-disk encryption cannot be trusted.

On a public repository, a job a stranger can start never runs on your machine. The routing expression sends a job there only for a push, a schedule, a manual run, the merge queue, a release or a pull request from the repository's own branches; fork pull requests, comments and discussions stay on GitHub-hosted (Workflows). As a second line, the control plane reads each job's run from GitHub before any machine takes it and refuses one started by any other event, whatever the workflow says, then re-runs it on GitHub-hosted.

Joining a pool, marking a machine as trusted, routing a repository with secret-bearing jobs and turning isolation off each need the owner or an admin. A coding agent prepares the step and returns needs_human. Every job records the machine, its trust tier, the image digest and the agent and runner versions it ran with. The full picture is on the security page.