Airlock

Airlock is a containment-first security gateway designed to analyze untrusted code, packages, and AI-generated scripts before they are executed by developers or AI agents. Instead of relying blindly on package descriptions, comments, or README files, Airlock observes what code actually does at runtime inside an isolated sandbox and generates an evidence-based security report. The platform follows a structured six-stage pipeline: Fetch, Plan, Run, Observe, Verify, and Verdict. Utilizing advanced infrastructure features like Docker with the gVisor runtime (`runsc`), synthetic canary credential files, an isolated Honeynet for network containment, and strict resource limits, Airlock safely exposes malicious behaviors such as unauthorized file access or data exfiltration. Developed for the Vultr Agent Rush Hackathon (Challenge 1 — Blast Radius Zero), Airlock separates its Control Plane (built with Next.js, FastAPI, and PostgreSQL) from the Sandbox Host to ensure complete security hygiene. By comparing an artifact's stated purpose against its actual runtime behavior, Airlock bridges the gap between trust and verification in modern AI-driven software development.