Security model

Outbound requests

See the security page for the policy. Operators configure NETWORK_POLICY=public in production; the test-fixtures policy is refused by startup validation there.

Probes

Probes authenticate with hashed tokens, lease work with per-run tokens and submit results that are verified against the lease, probe identity and configuration version. Revoking a probe releases its leases.

Secrets

APP_ENCRYPTION_KEYS holds versioned 32-byte keys. Rotate by adding a new version, making it active, and letting rotation re-encrypt stored secrets.

Environment

Production startup refuses default secrets, the development mail sink, billing overrides and the fixture network policy.

Required two-factor authentication

Account owners can require two-factor authentication for every human member from Team and clients → Security policy. Owners must enable two-factor on their own account first, so the policy can never lock out the person who set it. Members without two-factor are redirected to their account page, where they enable an authenticator app and then return to the workspace. The change is recorded in the audit log.

API credentials under a two-factor requirement behave as follows:

• Existing API keys keep working. They are machine credentials bound to the account, not to a person's second factor, and services using them are not interrupted when the policy is switched on.
• Issuing, rotating and revoking keys are human actions performed in the workspace, so they require a signed-in member who satisfies the policy. A member without two-factor cannot open the workspace and therefore cannot create keys.
• Revocation takes effect immediately for the revoked key only; other keys are unaffected.
• Probe tokens follow the same rule as API keys: they are not subject to the human two-factor policy.