Security best practices

This page covers essential security guidelines for protecting your Spheron account, API credentials, and GPU instances. Apply these practices before deploying in any production environment.

Account security

• Use strong, unique passwords
• Never share passwords, API keys, SSH keys, or payment info
• Verify URLs before entering credentials (official: spheron.network)

• Watch for fake support messages and impersonation attempts
• Use only official channels (see General Info)
• Verify domains before clicking links

SSH keys

SSH keys are required for instance access. Only upload public keys to Spheron.

• Generate keys using ED25519 or RSA 4096-bit
• Use passphrases on private keys; never share them
• Store private keys in a secure location, not in repositories
• Rotate keys every 90 days
• Use different keys for different services

See SSH Connection Guide for setup.

API keys

API keys provide programmatic access to your account. See API Reference for endpoint details.

• Store API keys in environment variables; never hardcode them
• Rotate every 90 days
• Revoke immediately if compromised
• Use separate keys per environment
• Never commit API keys to version control

export SPHERON_API_KEY="<your-api-key>"  # Store in environment, not in code

Monitoring and alerts

Monitor regularly to detect unauthorized access:

• Active instances and deployments
• Billing and credit usage
• API activity logs

To set up alerts:

• Enable billing notifications in User Settings
• Set spending limits
• Track unusual activity patterns

See Billing for monitoring details.

Instance security

• Close unnecessary ports
• Configure firewall rules
• Disable password authentication; use SSH keys only
• Use VPN or SSH tunneling for sensitive services

• Keep software updated
• Apply security patches promptly
• Monitor system logs regularly
• Back up important data before terminating an instance

• Review scripts before deployment (they run with root privileges)
• Never hardcode credentials in scripts
• Use secrets management for sensitive data
• Test scripts in a development environment first

See Connecting to instances for startup script examples.

Official channels and support

For a complete list of official Spheron channels and contact information, see General Information.

Always verify you are on the correct official domain before:

• Entering login credentials
• Connecting your wallet to any website
• Sharing sensitive information
• Clicking links in messages or emails

Bookmark official URLs and double-check domains to avoid phishing attempts.

AI connections

An AI connection lets an assistant act on your account, so treat it like a key:

• Set a spend limit. Pick an hourly limit on each connection rather than No limit, so a mistaken request cannot launch more than you planned.
• Read every preview. Approve a launch, stop, or delete only after checking the price, SSH key, and target in the preview.
• Check the sign-in page. It names the connecting app and where its sign-in finishes. Click Allow only when both match the client you are setting up.
• Disconnect what you no longer use. Remove stale connections in Settings > AI connections.

Reporting security issues

If you suspect unauthorized access or find a vulnerability, take these steps immediately:

1. Change your account password
2. Revoke compromised API keys and SSH keys, and disconnect unrecognized AI connections
3. Terminate any suspicious instances
4. Review billing for unauthorized usage

Then report the issue:

• Contact through official channels (see General Info)
• Provide timestamps, affected resources, and observed behavior
• Report phishing attempts to help the community

Security checklist

• Strong unique password set
• Regular activity reviews scheduled

• Only SSH public keys uploaded
• Passphrases set on private keys
• 90-day key rotation scheduled
• API keys stored in environment variables
• Spend limit set on every AI connection

• Firewall configured
• Software kept up to date
• Unnecessary ports closed
• Instances terminated when not in use

What's next

• Getting Started: Account setup
• SSH Connection Guide: SSH configuration
• API Reference: API key management
• AI connections: Connect assistants with a spend limit
• User Settings: Account settings
• General Info: Official channels