Security
Secrets, API tokens, roles across organizations and workspaces, sessions, and what agents may touch.
Where secrets are allowed to live, how free scoped API tokens work, how platform, organization and workspace roles combine, and the boundaries agents cannot cross.
Secrets
- YAML holds
${VAR}references; a literal secret fails validation. .envfiles are parsed into a private map, never intoprocess.env.- Integrations and MCP servers store variable names only.
- Logs, HAR files and screenshots are redacted or masked by key pattern and
maskselectors.
API tokens
Tokens are free, unlimited, scoped and revocable. Format amx_ plus 40 characters; stored as SHA-256; shown once.
bun run sdods tokens create --user ci --name ingest --scopes runs:ingest,runs:read --expires 90d
bun run sdods tokens list
bun run sdods tokens revoke <id>A token's scopes must be a subset of its owner's role, at creation and at use.
Roles
The effective role inside a workspace is the higher of the explicit workspace membership and the role implied by organization membership; platform admins are admin everywhere.
| Scope group | viewer | editor | admin |
|---|---|---|---|
*:read (except audit:read), artifacts:read | ✔ | ✔ | ✔ |
runs:write, runs:ingest, features:write, datasets:write, envs:write, schedules:write, processes:write, agents:* | ✔ | ✔ | |
users:admin, orgs:admin, workspaces:write, integrations:write, audit:read | ✔ |
Sessions
HttpOnly, SameSite=Lax cookies with sliding seven-day expiry; every non-GET request carries a CSRF header; login is rate-limited.
Each user can see and end their own sessions under Settings → Password & sessions: the browser, IP
address, last activity and expiry of every signed-in session, with the current one marked. Changing
a password there requires the current password, is rate-limited, and signs out every other session.
All of these routes refuse API tokens, so a leaked token cannot lock its owner out. Every change is
recorded in the audit log (user.profile.update, user.password.change, user.session.revoke).
Agents
Agents can read the project, run scenarios and drive a browser. Their only write path is a proposal directory. Nothing reaches main without a person accepting it.
What each agent adapter sends to its provider, what is redacted on the way and how to run with no
provider at all is documented, against the code, in
docs/security/ai-data.md
in the repository. In short: running tests sends nothing to any AI provider; an agent sends a small
first prompt plus the tool results the model asks for, with secret-looking keys masked; and
--dry-run or a local Ollama model keeps everything on your machine.
Telemetry
SDODS has none. The CLI, the runtime, the server, the web UI and the MCP server send no usage data,
crash reports or analytics anywhere. They make network calls only to what you point them at: your
application, the LLM provider an agent uses, the npm registry for sdods upgrade, and your own
server, GitHub or Jira when you configure them.
- The desktop app checks the public releases repository for updates. Turn that off with
SDODS ▸ Check for Updates Automatically, or launch it with
SDODS_DESKTOP_NO_UPDATE=1. - sdods.com counts page views anonymously: no cookies, no stored identifiers, and nothing is sent when the browser sends Global Privacy Control or Do Not Track. docs.sdods.com has no analytics.