Small teams get the same phishing emails as big companies, without a security team to ask. "Is this invoice safe to open?" usually gets answered by opening it.
Burn Box answers it for them, and nobody has to open anything. Forward the suspicious email to Burn Box, or drop in a file or a link. Even reading the email happens inside a sealed box: Burn Box checks who really sent it, whether the sender's domain vouched for it, where replies really go, and whether its links lie about where they lead. Then it splits the email up. Every link and every attachment gets a fresh box of its own, running side by side.
For each part, Burn Box seals a fresh container on a Google Cloud VM: no network, a read-only system, no privileges, strict CPU, memory, process and time limits, and gVisor as a second kernel wall. It plants fake secrets inside (a cloud key, a crypto wallet, a password file) whose only job is to be reached for. Then it detonates the sample. Files run under strace, and links open in headless Chromium on a private lab network. Every file touch, process, connection attempt and form submission streams live to the screen. When the run ends, the box is destroyed and its removal confirmed.
The model reads the behavioural record and writes the verdict in plain English: what the sample pretended to be, what it actually tried, which canaries it reached for, how many escape attempts the wall stopped, and safe, suspicious or malicious with reasons. A rules floor from the evidence sets the minimum verdict; the model can raise it but never lower it, so a sample cannot talk its way to a softer verdict. If the model is unreachable, the rules verdict stands and the receipt says so honestly.
Every run ends with a signed receipt (Ed25519): the container, the limits applied, the canaries and the destroyed-at time. Receipts are publicly verifiable on the verification page, where anyone can paste or upload a receipt and check the signature.
Burn Box also keeps a verdict history with team workspaces: a team shares runs through an unguessable code, no accounts needed, and team runs stay off the public list. A link-only quick check answers "is this URL safe?" with the same signed receipt as a full run.
The demo is an "invoice overdue" email with two traps, saved unopened and dropped into Burn Box. The envelope box finds a spoofed sender (SPF, DKIM and DMARC fail), a reply-to address on a lookalike domain, and a link whose text lies about where it goes. Then two more boxes open. The attachment reads the planted cloud key and wallet, tries to send them home, tries to install itself and tries to delete shared files, and is blocked at every step. The link is a fake sign-in page. Burn Box types a fake login into it and traces the details to a collector on a different site. No human approval is needed, because nothing real is ever entered. Three boxes, three burns, one verdict: Malicious, delete it without opening anything.
The containment moment is the product. Burn Box does dangerous work that is only safe because of the box, and it shows the box holding in real time.
For judges: the demo is open, no account or credentials needed. Run a sample, a file, or a link from the homepage. To try the team workspace, create a team on the site and note the code it shows once; the quick check is the link field marked quick, and receipt verification is the verify view linked from every receipt. Every test sample is self-written and does nothing outside a Burn Box; there is no real malware in the repo or the demo, and the collector and fake sign-in page live on a private network with no route to the internet.
The code is public and the demo is live; both are linked on this page.
Built With
- chromium
- cloud
- docker
- ed25519
- events
- gvisor
- node.js
- playwright
- python
- server-sent
- strace
- typescript
