# Troubleshooting Start by checking the session state and account you are using. Keep the session ID and launch request key when asking for help; leave out passwords, private keys and API credentials. ## The CLI command is missing Activate the virtual environment where you installed the repository, then run `python -m pip install -e .` from the checkout. `sr --help` should show `launch`, `images`, `credits`, `get`, `list` and `destroy`. The legacy `security-run` command is not the OS-session CLI. For Node.js, install the package from the actual `sdk/javascript` directory. Use ESM (`.mjs` or `"type": "module"`) and Node.js 20+. The current SDK is not a public-registry installation. ## Sign-in or credential errors - **Browser asks for confirmation:** follow the email confirmation link before launching. Use **Forgot password?** if you cannot sign in. - **SDK says a credential is missing after `sr login`:** the SDK does not read the CLI config. Set `SECURITY_RUN_API_KEY` in the SDK process or pass it to the constructor. - **`sr login` says the file exists:** it will not overwrite an existing credential file. Use a new path with `sr --config ~/.security-run/new-profile.json login` and select that path for later commands. - **Browser and CLI show different balances or sessions:** their credentials resolve to different account identities. Ask the operator to map your API access to the intended browser account. - **A session link gives no access:** sign in as the owner. Session links do not share access with another account. ## There are credits, but launch is rejected Look at **available** credits, not the total purchased or the Stripe statement balance. Usage from running systems is deducted continuously. A new launch needs enough for the 60-second compute minimum, without a separate buffer or hold. Add credits or activate an eligible trial. Finish existing sessions to stop their usage. A trial allows only one active VM and no more than 30 minutes per session. Funded accounts allow five active VMs and up to four hours. A quote does not bypass these limits. A card that already claimed a trial cannot claim another one. A paused billing account needs support review. Global trial availability can also be temporarily exhausted. ## Startup takes longer than expected Check `sr get SESSION_ID`, `session.refresh()`, or **My sessions**. `queued` and `launching` are intermediate states. Do not create another launch just because a connection is taking time; retry an uncertain request with its original key and identical options. If an SDK readiness wait expires, use the error's `session_id` (Python) or `sessionId` (JavaScript) to inspect or destroy the VM. The default readiness timeout is 900 seconds in Python and 900,000 milliseconds in JavaScript. It is a client wait limit, not a VM lifetime extension. A terminal failure requires a new launch with a new key. Failed startup does not consume compute credits. ## The API says ready, but the screen is still loading The web app waits for the browser gateway and its first display update. This can finish after VM readiness. Use the reconnect control if the connection drops, or reopen the session from **My sessions**. Check whether the session expired before retrying. Direct SSH/RDP uses your own network connection. It can fail when your source network is not allowed, even when browser access works. Ask the operator about the native-access allowlist; do not disable host-key or certificate checks to resolve a network problem. ## Copy/paste or keyboard shortcuts do not work Click inside the VM first. On a Linux terminal, use Cmd+C/V on macOS or Ctrl+Shift+C/V on Windows/Linux. Ctrl+C is the shell interrupt, and Ctrl+V remains a terminal control. Some shortcuts are reserved by the browser or operating system. If browser clipboard access is unavailable, use the **Clipboard** side panel to send or copy text. Clipboard support is for plain text. Use **Files** for files and binary content. ## Files are missing or a transfer failed Browser uploads are limited to 100 MiB per file. Linux files arrive under `/home/runner`; Windows files appear in the **SecurityRun** redirected drive. A download needs its final **Save** step after the transfer completes. Download needed files before destroying the session. VM disks are ephemeral. Windows redirected-drive content is also temporary and can be lost if the gateway is replaced. Use an allowed native SSH/SFTP or RDP connection for larger transfers. ## My script exited, but the VM is still running Process exit, closing the client, and closing a browser tab do not stop a VM. Use Python's session context manager, JavaScript's `withSession()`, a `finally` block, or an explicit `sr destroy SESSION_ID`. A launch error can happen before a cleanup context was entered. Save the request key and session ID so you can recover. If destruction times out, inspect the state and retry; server-side expiry remains in force. Final outbound measurements can arrive several minutes after termination; compute stops at confirmed termination. ## Get help Contact [support@security.run](mailto:support@security.run) with the session ID, OS, approximate time, action you tried and error text. For an uncertain launch, include the idempotency key. Do not send card data, API credentials, private keys, passwords, clipboard text or investigation files.