How it works Docs Prices
Login Sign up
Browse documentation

Security guidance

Secrets

  • Never commit credentials to hosted Git repositories or ICE source.

  • Store sensitive values in secret groups; use variables only for non-sensitive configuration.

  • Secret values are not returned after saving. Re-enter a value when rotating it.

  • Avoid commands that print secrets into execution logs.

  • Use --password-stdin for Docker authentication.

Codinamo masks exact occurrences of attached secret values before persisting logs. Encoded, split, truncated, or otherwise transformed values may not match and must not be printed.

Access control

  • Grant responsibility to teams rather than repeating assignments for individual users.

  • Prefer built-in roles when they match the responsibility.

  • Give custom roles the smallest useful permission set and assignable scope set.

  • Grant at the narrowest practical resource scope.

  • Use expiration for temporary operational access.

  • Review inherited and team-derived access before removing a direct assignment.

grant:manage is an administrative permission. Restrict workspace-wide access administration to trusted operators because compatible grants can affect existing and future descendants.

Secret-group use permission does not reveal stored values. Do not combine broader secret management, pipeline editing, and execution permissions unless the responsibility requires all three.

Repository access

Use HTTPS and verify the host before entering credentials. Remove obsolete credential-manager entries when an account changes instead of disabling verification globally.

DinaSync

Enrollment tokens are short-lived and one-time. Deliver them through a secret manager or bootstrap channel. Keep the SQLite encryption key outside the database and load it as a systemd credential.

The agent uses outbound communication and mTLS after enrollment. Its deployment protocol accepts only versioned Docker strategies and does not expose a general-purpose remote shell.

Logs

Execution logs are user-visible diagnostics. Treat every action command as a potential source of disclosure and redact protected values before emitting output.

See How access control works and Manage access.