Is Codespaces Free

When developers ask is codespaces free, the answer is yes for personal accounts with monthly limits. Every individual user gets a set quota of free compute hours and storage each month.

Once you pass those monthly limits, you pay for extra compute and storage usage. Team and enterprise accounts do not share this personal free quota by default. Instead, billing admins set spending rules and usage caps at the group level.

How is codespaces free for engineers and AI agents

GitHub runs your remote workspace inside a cloud virtual machine with a container. Each virtual machine size uses a specific number of core hours while it runs. Smaller machines burn through your free monthly allowance much slower than larger machines.

Storage usage counts separately from active compute hours. Every workspace keeps your code files, packages, and container caches on a cloud disk. That disk uses your storage quota even when the virtual machine stops running.

To stay within the free allowance, engineers must manage their active and stopped workspaces. When a machine sits idle, an automatic timer puts it to sleep. Stopping a machine stops the compute clock right away. Still, you must delete old workspaces to free up your monthly storage quota.

Many engineers also run AI coding agents inside these cloud workspaces. Agents run tests, install packages, and build apps inside the remote container. This activity keeps the virtual machine awake and uses more compute hours. Teams must watch agent jobs so background tasks do not drain free quotas.

Security tradeoffs of cloud workspaces and static keys

Cloud workspaces make onboarding fast, but they bring clear security tradeoffs. To build apps and run tests, the remote machine often needs database keys. Developers usually store these static keys in account secrets or local files.

When the workspace starts, the cloud platform loads those secrets into the container. Once inside the session, both the developer and any AI agent can read them. Static keys and broad database roles cannot stop risky queries during an active session.

If a compromised package or rogue agent runs inside the workspace, it has full access. It can use those loaded keys to read production tables or export records. Standard cloud workspace controls only manage who can start the virtual machine. They do not inspect database commands or rewrite sensitive fields like emails and card numbers.

How to keep cloud workspace usage and risk low

First, set your idle timeout to a short window in your account settings. This stops you from paying for compute hours when you step away from work. Second, delete stopped workspaces as soon as you merge your pull request.

Third, use smaller machine types for basic code edits and docs tasks. Save the high-core machines for heavy builds or local test suites. Finally, avoid putting long-lived database keys or cloud admin tokens inside workspace secret stores. Limit what the remote machine can reach on your internal network.

Check database and API queries on the wire

Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.

Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.

Frequently asked questions

What happens when I hit my monthly free limit?

Your running workspace stops and you cannot start it again until the next billing cycle. To keep working right away, you must add a payment method and raise your spending limit.

Do stopped workspaces still use my free quota?

Stopped workspaces do not use any compute hours, which saves your main runtime quota. Still, their saved files still count against your free monthly storage allowance until you delete them.

Are prebuilds included in the free allowance?

Prebuilds use compute hours to build the template and storage space to hold the snapshot. Both actions pull from the same free monthly quotas on a personal account.

Related guides

• How Do I Setup Scim in Slack
• How Do Leading Platforms Ensure AI Outputs in Reporting Are Explainable and Auditable
• How Do Leading AI Bi Vendors Handle Row-level Security for Cross-functional Teams