Based on a feedback from multiple penetration tests and codes reviews, this talk answer practical questions concerning GAE: How secure is the Google GAE infrastructure? How Google protects your applications? How a GAE application hosted in Google datacenters may affect the security of your internal network? This talk is not about theory or trolling on “is-cloud-good-or-wrong”, but will present real-world attacks, including arbitrary code execution to escape the Python sandbox in the Google datacenters and exploration of the GAE platform outside of the Python sandbox. Nicolas Collignon has been auditing and pentesting information systems for more than 9 years. He’s the author of several publications such as “Playing with Windows /dev/(k)mem”, “Tunneling TCP over RDP: rdp2tcp”, “Shell over DTMF”, “VMware and virtualization security” or “JSF ViewStates upside-down”. He is currently leading the penetration testing team at Synacktiv. For the last 2 years, he has spent a considerable amount of time hacking Android operating system and Google services.