automaintainer/ docs
Dashboard →

Security & data

Automaintainer is built so the sensitive things stay on infrastructure you control. This page is the short, honest version of what's where.

Your provider keys never leave your worker

AM is BYOK. Provider keys are configured on your worker host and used only by the local harness. The panel never stores, reads, or transmits them.

Your code stays on your worker

Repositories are cloned to your worker for each run, in an isolated worktree. The panel stores run metadata (status, logs, diff stats, PR title/body) so you can review history — not your source tree.

GitHub access is scoped and masked

The GitHub token is used only to clone, push the run branch, and open/merge PRs. It's provided to runs per‑run and masked in all run/verify output — it is never printed in logs.

What AM can and cannot do

  • Can: read the repo, make changes within the bounded focus, run your verify command, push a branch, open a PR, and (on Max+) merge after a green gate + review.
  • Cannot: merge unverified work as ready (a red gate yields a draft); act outside the objective/playbook you set; or — in explore mode — touch blocked areas (public APIs, deletions, schema/auth/payment/secret/config).

Secrets at rest

Third-party secrets stored by the panel — GitHub tokens, SSH private keys, and SSO client secret / SP key — are encrypted at rest with AES-256-GCM when the operator sets a SECRETS_KEY. Values are decrypted only in memory when needed (e.g. to clone a repo or complete an SSO exchange) and are never returned by the API or printed in logs. Existing deployments encrypt new writes automatically once the key is set, and a one-time admin encrypt-secrets backfills older rows.

License key rotation

The worker license key is the token that authenticates a worker to the panel. When you click Regenerate key in Settings, the panel creates a new key and immediately invalidates the old one.

  • Push to connected workers. You can opt in to push the new key to any workers that are connected at the moment of rotation (notify_workers=1 in the API, or the "Also update connected workers" checkbox in the UI). The key is sent as a token_rotated worker command over the live WebSocket. The panel remembers your last UI choice in the browser so the checkbox keeps its state the next time you open Settings.
  • Offline workers need a manual update. Workers that are not connected when the key rotates, or whose send buffer is full, must be updated with the new --token before they can reconnect.
  • Connected workers keep the new key in memory. When a token_rotated command is delivered, the panel immediately updates each affected connection's stored AgentToken, so the next spawn for that worker is sent the new key rather than the old one.
  • Key material is never leaked. The new key value is returned in the license_key field of the rotation response; the old key is not returned at all. They are not written to panel logs, bus traffic, or other API fields. Internally, the Token field on worker commands is stripped from every command type except token_rotated by the MarshalJSON, UnmarshalJSON, String, and GoString guards, so a license key cannot accidentally ride along on a spawn, sync, ping, or other command, or appear in logs and debug formatters.

Isolation

Each run uses a fresh worktree from a clean checkout, so runs can't corrupt each other and results are reproducible.