Which data leaves your account, where each token is kept, and what cf-orbs doesn’t cover.
What leaves your network
- The provider connects out to Amp (
ampcode.com) for jobs. Nothing connects in. - Each orb connects out to
ampcode.com(tools) andtunnel.ampcode.com(portals, Terminal). - Amp runs the agent and the model on its own servers. What the agent reads in an orb (code, command output) goes to Amp and its model providers, as with Amp-hosted orbs.
- The repo checkout, build output and orb disks stay in your Cloudflare account.
Tokens
| Token | Where it lives | Notes |
|---|---|---|
Amp provider token (aop_live_...) |
Worker secret AMP_ORB_PROVIDER_TOKEN. Passed only to the provider container. In external mode, only on your host |
Never in an orb. Never logged |
| Control token | .cf-orbs/control-token (mode 600, git ignores it) and the Worker secret CONTROL_TOKEN |
The bearer for the public API. Whoever has it can start, pause and delete orbs and read their redacted logs. Keep it like a password |
ORB_TOKEN |
Amp makes a new one for each spawn | cf-orbs passes it to amp orb bootstrap in memory and never writes it to disk |
Logs and API responses go through redaction. Before a pause saves the disk, cf-orbs also masks token shapes (aop_live_, orb_, Bearer, JWT) in ~/.cf-orbs/bootstrap.log and ~/.cache/amp/logs/*.log.
What cf-orbs does not protect
- Egress is open. An orb can reach any host on the internet, like a laptop can. There is no allowlist mode.
- The orb user has passwordless
sudo. Amp’s image needs it. - Snapshot data outlives an uninstall. The container API can’t delete snapshots. Cloudflare keeps the data for up to 30 days after the last restore, unless
cf-orbs snapshots prune --yesdeletes it. debugExecis a hole. When it’strue, the control token can run any command in any orb. Keep itfalse.- Workers Builds installs. The default build token can deploy any Worker in the account, and
.cf-orbs/wrangler.jsoncin the repo names your account id.
Checks that help
cf-orbs doctor checks that no aop_live_ token or control token value is in a file that git tracks. It also checks the control token file mode. It warns when debugExec is on, and it fails when an image FROM has no digest.
cf-orbs init --no-deploy looks for tokens in the files it stages for the first commit, and stops if it finds one.
To report a vulnerability, see the security policy.