Troubleshooting

Start by checking the session state and account you are using. Keep the session ID and launch request key when asking for help; leave out passwords, private keys and API credentials.

The CLI command is missing

Activate the virtual environment where you installed the repository, then run python -m pip install -e . from the checkout. sr --help should show launch, images, credits, get, list and destroy. The legacy security-run command is not the OS-session CLI.

For Node.js, install the package from the actual sdk/javascript directory. Use ESM (.mjs or "type": "module") and Node.js 20+. The current SDK is not a public-registry installation.

Browser asks for confirmation: follow the email confirmation link before launching. Use Forgot password? if you cannot sign in.
SDK says a credential is missing after sr login: the SDK does not read the CLI config. Set SECURITY_RUN_API_KEY in the SDK process or pass it to the constructor.
sr login says the file exists: it will not overwrite an existing credential file. Use a new path with sr --config ~/.security-run/new-profile.json login and select that path for later commands.
Browser and CLI show different balances or sessions: their credentials resolve to different account identities. Ask the operator to map your API access to the intended browser account.
A session link gives no access: sign in as the owner. Session links do not share access with another account.

There are credits, but launch is rejected

Look at available credits, not the total purchased or the Stripe statement balance. Usage from running systems is deducted continuously. A new launch needs enough for the 60-second compute minimum, without a separate buffer or hold.

Add credits or activate an eligible trial. Finish existing sessions to stop their usage. A trial allows only one active VM and no more than 30 minutes per session. Funded accounts allow five active VMs and up to four hours. A quote does not bypass these limits.

A card that already claimed a trial cannot claim another one. A paused billing account needs support review. Global trial availability can also be temporarily exhausted.

Startup takes longer than expected

Check sr get SESSION_ID, session.refresh(), or My sessions. queued and launching are intermediate states. Do not create another launch just because a connection is taking time; retry an uncertain request with its original key and identical options.

If an SDK readiness wait expires, use the error's session_id (Python) or sessionId (JavaScript) to inspect or destroy the VM. The default readiness timeout is 900 seconds in Python and 900,000 milliseconds in JavaScript. It is a client wait limit, not a VM lifetime extension.

A terminal failure requires a new launch with a new key. Failed startup does not consume compute credits.

The API says ready, but the screen is still loading

The web app waits for the browser gateway and its first display update. This can finish after VM readiness. Use the reconnect control if the connection drops, or reopen the session from My sessions. Check whether the session expired before retrying.

Direct SSH/RDP uses your own network connection. It can fail when your source network is not allowed, even when browser access works. Ask the operator about the native-access allowlist; do not disable host-key or certificate checks to resolve a network problem.

Copy/paste or keyboard shortcuts do not work

Click inside the VM first. On a Linux terminal, use Cmd+C/V on macOS or Ctrl+Shift+C/V on Windows/Linux. Ctrl+C is the shell interrupt, and Ctrl+V remains a terminal control. Some shortcuts are reserved by the browser or operating system.

If browser clipboard access is unavailable, use the Clipboard side panel to send or copy text. Clipboard support is for plain text. Use Files for files and binary content.

Files are missing or a transfer failed

Browser uploads are limited to 100 MiB per file. Linux files arrive under /home/runner; Windows files appear in the SecurityRun redirected drive. A download needs its final Save step after the transfer completes.

Download needed files before destroying the session. VM disks are ephemeral. Windows redirected-drive content is also temporary and can be lost if the gateway is replaced. Use an allowed native SSH/SFTP or RDP connection for larger transfers.

My script exited, but the VM is still running

Process exit, closing the client, and closing a browser tab do not stop a VM. Use Python's session context manager, JavaScript's withSession(), a finally block, or an explicit sr destroy SESSION_ID.

A launch error can happen before a cleanup context was entered. Save the request key and session ID so you can recover. If destruction times out, inspect the state and retry; server-side expiry remains in force. Final outbound measurements can arrive several minutes after termination; compute stops at confirmed termination.

Get help

Contact support@security.run with the session ID, OS, approximate time, action you tried and error text. For an uncertain launch, include the idempotency key. Do not send card data, API credentials, private keys, passwords, clipboard text or investigation files.