InstaVM vs Vercel Sandbox

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Vercel Sandbox 82

@vercel/sandbox 3.9.1 tagged on 28 October 2026 (30). The repository's tags show 16 stable releases from 3.0.0 on 7 August to 3.9.1 on 28 October, with the CLI package (sandbox) at 4.11.1 the same day (20). We couldn't read issue replies on vercel/sandbox (GitHub's pages answered 403), so this rests on the public changelog (10). Current official JavaScript and Python SDKs, per the 1 October check for Python (15). The publish workflow runs pnpm test on every push to main and every pull request, and 3.7.0 moved to @vercel/oidc v4. We couldn't confirm the default branch is passing (7). 30+20+10+15+7 = 82.

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

Vercel Sandbox 86

Vercel OIDC tokens tied to one project, which vercel env pull hands out for 12 hours, or access tokens elsewhere. Access tokens reach a whole team rather than one sandbox (25). Each sandbox is a Firecracker microVM with its own kernel (10). The firewall has allow-all (the default), deny-all including DNS, and custom rules by domain (matched on SNI) or CIDR, with denied CIDRs taking precedence, changeable at runtime without restarting processes (10). Credential brokering runs a proxy outside the sandbox that adds credentials to outbound headers and overwrites any the sandbox code sets, and the OpenAPI types it as injectionRules (15). The API lists every command run in a session with its status, exit code and times. We found no team audit log entry for sandbox activity (8). Valid security.txt pointing to HackerOne and responsible.disclosure@vercel.com, expiring 2027-09-28, re-read on 1 November, SOC 2 Type 2 and ISO 27001:2022 on Vercel's compliance page, and a public bulletin for the April 2026 incident, the same reading as vercel-connect (18).

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

Vercel Sandbox 50

No x402, MPP or L402 (0). Per-unit prices published by region, $0.128 an Active CPU hour and $0.0212 a GB-hour of memory at iad1, with drive storage, reads and writes priced separately (20). Hobby includes 5 Active CPU hours and 5,000 creations a month at no cost. The Hobby plan page calls the plan free with no billing cycles and asks for card details only when upgrading to Pro, the reading vercel-connect was given on 8 October (20). Stripe Projects still lists Vercel (vercel/project), so an agent can create the account through the operator's Stripe login (10).

InstaVM 66

A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.

Vercel Sandbox 88

Vercel's public OpenAPI 3.0.3 document, re-read on 1 November, has 27 Sandbox paths and 33 operations under /v2/sandboxes to /v4/sandboxes, covering sandboxes, sessions, commands, files, snapshots, drives and network policy. The 1 October check didn't find them (25). Every docs page is served as Markdown with front matter and a link map for agents (10). The docs explain when to use persistent or ephemeral sandboxes, drives or snapshots, and how Active CPU billing works, with worked cost examples (15). Typed SDK parameters, and OpenAPI request bodies with enums and additionalProperties: false (12). KB guides and examples throughout. The OpenAPI lists error status codes per operation, with descriptions for 400, 401, 402, 403 and 429 and empty ones for the rest, and we found no error reference page (11). Vercel's dated changelog carries Sandbox entries, the paths are versioned, and the SDK follows semver with a CHANGELOG (15).

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Vercel Sandbox 73

Sandbox objects are small, with no field selection (15). Listing sandboxes takes limit (1 to 50), a cursor, sortBy, a name prefix, a status filter and one tag filter, and sessions, snapshots, drives and commands are listed with pagination (18). Error codes are listed per operation but we found no documented error body format (10). Sandbox.getOrCreate with a name lands retries in the same sandbox, and SDK 3.6.1 recovers interrupted command waits without rerunning commands (15). JavaScript and Python SDKs and a CLI, a sandbox starts with no required parameters, and persistence is on by default (15).

InstaVM 57

Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.

Vercel Sandbox 78

The SDK and CLI are Apache-2.0. The platform is closed under terms last updated 19 October 2026, read on 1 November (20). The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise, uses the 2021 SCCs and the UK addendum and has customer data deleted within a commercially reasonable time after termination. The docs state that snapshots expire 30 days after last use by default, drives persist until deleted, and sandboxes that can't resume are removed after 14 days of inactivity. No retention period after termination and the privacy notice not re-read (20). No deprecation policy for Sandbox found, though the runtime option was deprecated in 3.0.0 with a migration table (5). 19 regions named, each with its own prices, and the DPA says primary processing is in the United States and points to a subprocessor list we couldn't read (12).