Zero-Trust Autonomous Execution
Nimbus is engineered from the ground up to treat all user repositories and generated code as untrusted, enforcing strict isolation across every stage of the execution lifecycle.
Ephemeral Sandbox Isolation
Every agent task executes inside an ephemeral Docker container or isolated Linux subshell. No persistent disk access, no host root access, and the workspace directory is completely purged immediately after execution.
Secret Redaction & BYOK Isolation
API keys and tokens (Gemini, Groq, OpenRouter, GitHub PATs) remain strictly in backend environment variables. They are never transmitted over WebSockets, never stored in client browser state, and are redacted from public event logs.
Zero-Pollution Git Branches
Nimbus never commits directly to your production or main branch. All code modifications are committed to an isolated nimbus/task-{id} branch and delivered as a GitHub Draft Pull Request for human code review.
Multi-Tier Circuit Resiliency
The 3-tier routing stack incorporates exponential backoff and jittered retries to protect against upstream outages and rate limits, guaranteeing zero execution crashes during LLM demand spikes.