Security and data

What a session can do

Every session runs in a sandbox on your machine. Nothing runs outside it.

• It writes only to its worktrees, the temporary folder and the caches in your home. Never to the Runner's data, your SSH keys or your git configuration.
• It reads everything else but the Runner's data, your SSH keys, your git logins and the files your repository's git ignores. Every .env, .env.* and .envrc is hidden from it, but .env.example.
• It reaches the network, but never your code host. The Runner pushes the ticket's branch for it, and only that branch.
• The planner's git writes nothing and reaches no host.

While a run lives, the credentials its tools need are in the run's folder, readable only by you, and the folder is removed when the run ends.

Organizations are kept apart

Each organization sees only its own work. Before the beta, every door of the service, each route, tool, job and background loop, was tested with two organizations, and no hole was found.

What Tillerly keeps

• Run logs. What the agent said, the tools it called, and the result. Your organization chooses how long they are kept, 1, 7, 14, 30, 60, 90, 180 or 365 days, 30 by default. Then the log is deleted, and the run keeps its status, its cost and its final report.
• Credentials, encrypted, as the page on connectors says.
• Tokens and passwords, never in clear. Tokens are kept as hashes, passwords with scrypt.

Signing in

Signing in sets a cookie no script can read, sent only to the dashboard's own host. It ends after seven days unused, or 30 days at most.