Endpoint security

Status: draft production requirements. Public supplier registration and HTTPS inference are not available. A URL passing JSON Schema is not proof that it is safe to call.

Destination policy

Register only an endpoint you operate or are authorized to expose to CheapGPU. An automatic endpoint-control verification mechanism must be defined before external registration can trigger active probes; compatibility checks alone do not establish that authority.

The production HTTP-versus-DNS choice, shared-tenant authority scope, proof renewal and enforcement before external conformance remain release requirements.

Accept only a fully parsed HTTPS URL with a public DNS hostname on port 443. Reject IP literals, userinfo, queries, fragments, malformed hostnames, alternate schemes, and arbitrary ports. Do not follow redirects. A public hostname must not resolve to loopback, private, link-local, multicast, reserved, or other non-public destinations, including IPv6 and IPv4-mapped IPv6 forms. Block cloud metadata addresses and CheapGPU-owned control-plane/internal destinations.

Validate the actual destination before every new connection. Resolve all address records, reject a response containing any disallowed destination, and connect only to a validated address without another unchecked resolution. Preserve the original hostname for TLS certificate verification, SNI, and HTTP authority. Revalidate on a new resolution or connection, including after a DNS change. Do not allow proxy configuration, address fallback, or connection pooling to bypass these checks or mix credentials between configurations.

Apply network egress restrictions as well as application validation. An endpoint registration must never let a supplier probe platform networks. These rules follow the threat model in the OWASP SSRF prevention guidance. The exact network implementation remains a release blocker.

Credentials and records

Use an endpoint-scoped credential binding backed by a managed secret store. Only the bound workload receives the value at execution time. Do not store credential values in endpoint JSON, URLs, Terraform state, documentation, logs, or check reports. A credential rotation creates a new configuration revision; an old pass does not certify the new binding.

Never forward buyer authorization headers, platform cookies, or arbitrary supplier-provided headers. Credential provisioning, workload identity, rotation, and revocation APIs must be defined before external onboarding. No real credential is needed to validate this repository’s synthetic examples.

Resource bounds

Checker and gateway need bounded requests, response/event sizes, timeouts, queues, concurrency, and output limits. The checker additionally needs a persisted per-run request budget and immutable deadline. A declared max_completion_tokens is not a substitute for transport resource limits.