Credentials and access
Selected GitHub repositories
The preferred GitHub App uses one-hour installation tokens and can be installed on selected repositories. Legacy OAuth remains available only when the App is not configured.
Dedicated deployment keys
Alkimist generates a separate SSH key. Personal private-key uploads are not accepted. Private halves are encrypted at rest and never returned to the browser.
Encrypted secrets
Provider tokens, environment variables, generated SSH private keys, webhook secrets, and managed TLS private keys use application-level encryption before database storage.
Revocation
Remove the GitHub installation, delete the deployment key, and remove its public line from your server's authorized_keys file to revoke access.
Deployment boundary
Applications run on servers you own. Alkimist's control plane stores configuration and coordinates work through an isolated per-account runtime workspace. It connects to your server over SSH for builds, releases, health checks, logs, and operations you request. Alkimist does not become your VPS provider.
Audit events record important product actions. Their retention is configurable from 7 to 365 days. No independent security audit or formal compliance certification is claimed today.
Report a vulnerability
Send a clear description and reproduction steps to [email protected]. Please do not access other users' data or disrupt production while testing. We will acknowledge a credible report as quickly as practical.