Security model

Multi-factor authentication (TOTP) is required for every member, with bot and fraud detection at sign-up and sign-in. The sign-in callback is checked against a state cookie.

A __Host- cookie, HttpOnly, Secure and SameSite=Lax, holding a random token. We store only its SHA-256, and the identity provider's refresh token encrypted. Sessions end after 30 days, or 7 days idle.

Every 5 minutes a session re-reads the member's role. If the identity provider is unreachable, a session lasts 15 more minutes, then fails closed. Removing a member revokes their sessions; changing a role takes effect on their next request.

Dashboard writes must come from https://app.shiftlabs.org; anything else is refused.

256 random bits, one workspace and one role each, expiring after 1–365 days. We store the SHA-256 and show the key once. A key's role cannot exceed its creator's.

viewer < developer < admin, checked on every route. See what each role can do.

Every API query is scoped to the caller's workspace, which comes from the credential and never from the path or body. Another workspace's trigger or run answers 404.

Failed API authentication counts against a per-IP limit: after 10 a minute, further attempts get 429.

Trigger ids are 128 random bits, so URLs are unguessable. Developers can rotate or revoke them at any time, and viewers see them masked.

Optional per trigger: shiftlabs (a secret we generate), stripe or github. Timestamped signatures must be within 5 minutes, and replayed deliveries are dropped.

Encrypted with AES-256-GCM and bound to their trigger. A generated secret is returned once; a secret you supply is never returned.

Per edge location: 100 requests per 10 seconds per trigger and 600 requests a minute per IP across the API and webhooks. At the edge, an IP sending more than 150 requests in 10 seconds to the webhook host is blocked.

A webhook body is capped at 256 KiB.

Each workspace's values are encrypted with its own data key (AES-256-GCM, bound to the workspace, the secret's name and its version). The data key is itself encrypted under a platform key.

Your code holds a stand-in, never the value. The gateway swaps the value in only for the secret's own hosts (exact names, no wildcards or IP addresses, https only) and only for a stand-in made in the same run; to any other host the request gets a 403. Text that only looks like a stand-in is left alone.

For admin-fixed placement, the workflow must declare the connection and the host must be on its exact list. The gateway applies the template to every request to its hosts and overwrites whatever the code set. Redirects are not followed for any request that carries a secret.

If an upstream echoes a secret, or a reversible encoding of it such as base64 or Basic auth, it is replaced with [redacted] before your code sees the response. Readable secrets are scrubbed from logs.

Only secrets marked readable are returned by reveal(). A secret marked hmac can only produce signatures through sign(); the value never enters your code.

Every use or refusal of a secret is written to the audit log, which admins read at /v1/audit.

Every deploy is scanned. WebAssembly, crypto-mining code and raw sockets are blocked. URLs with IP addresses, unusual ports or shiftlabs.org hosts, and hard-coded credentials, come back to you as warnings. Other patterns are flagged for review by our operators.

Every hour we look at usage signals across workspaces, such as traffic concentrated on one host, failing or scanned targets, blocked requests and CPU use. New workspaces, and workspaces whose current code is flagged, are held to stricter thresholds. Flags go to an operator.

A suspended workspace has its active runs stopped, and its webhooks, runs and API writes are refused. You can still read and revoke triggers, API keys and members.

Send reports to abuse@shiftlabs.org with the X-Shiftlabs-Tenant value from the request. It identifies the workspace to us without telling anyone else which customer it is.

Runs execute in US regions only.

HTTPS only, TLS 1.2 or later, with HSTS. Plaintext HTTP is refused with 403, and the app, API and webhooks answer on their own hostnames only.

API responses are never cached and cannot be framed or content-sniffed.

Run telemetry uses separate credentials to write and to read: the component that writes cannot read it, and the API that reads cannot write it.

This site loads no third-party scripts, fonts or trackers, under a strict Content Security Policy.