Security and isolation
Your jobs run code you didn't write: dependencies, build scripts, and changes from people and agents. So every job starts on a clean machine of its own, and nothing it does carries over to the next one.
CI Runners Coming (phase 3)
- A fresh virtual machine per job. Each job gets a new virtual machine, terminated when the job ends and never reused.
- Nothing reaches in. No inbound network access, and no cloud credentials the job can reach.
- A token that works once. Each runner registers with GitHub using a registration token that works once, and its runner configuration is never stored.
- Caches kept apart. Once caching opens, each cache belongs to one Organization and one repository.
Secrets and keys
- Secrets in a managed secret store. The keys and secrets OhMako holds live in a managed secret store, never in code.
- Checked webhooks. We check every webhook's signature before acting on it.
- API keys we can't read back. When API keys arrive, we'll store only a SHA-256 hash of each one.
Security Testing Coming (phase 6)
- Only a sealed copy. It attacks only a copy of your app, started in a sealed sandbox, never your servers.
- No production credentials or data. The sandbox holds test data, and no credentials for your production systems.
- Controlled outbound network. Outbound traffic from the sandbox will be limited, so a test can't reach your production systems.
Report a security issue
If you find a security issue in OhMako, write to us.