Provider credentials never reach us
Runners read provider keys from their own environment. The API accepts only sanitized resource identifiers, rejects secret-shaped blueprint fields, and the database has no columns for provider secrets.
Security
Designed so the control plane never holds your provider credentials
EnvTie.dev coordinates your environments without storing Neon, Upstash, Vercel, Stripe, or other provider API keys. Runner tokens, sealed Slack webhook URLs, and account data are still stored so the product can operate.
Every plan is signed
The control plane signs workspace-bound plans with Ed25519. Runners verify the signature, the workspace, and the expiry against the operator-configured public key before executing, and refuse everything else.
Pinned adapters
Signed plans pin each adapter release by SHA-256. Runners download only selected adapters, verify them before execution, and pass only the environment variables each adapter declares.
Least-privilege runners
Runner tokens are random 256-bit values stored as SHA-256 hashes, expire after 30 days, and can be revoked at any time. Runners make outbound HTTPS calls only.
Sessions and access
Sign-in uses OpenID Connect with PKCE. Tokens stay in an encrypted, HTTP-only cookie and are never exposed to browser JavaScript. Every workspace request checks membership and role.
Supply chain
Release images are built in CI with SBOM and provenance attestations. Dependabot, govulncheck, npm audit, and CodeQL run continuously.
Data we process
Account data (name, email address, and the identifier from your identity provider), workspace, project, and environment names, blueprints, provider resource identifiers and status, signed plans, runner token hashes, optional sealed Slack Incoming Webhook URLs, and an activity log of changes. Billing is handled by Stripe; we store only the Stripe customer and subscription identifiers. Optional Slack lifecycle messages never include provider secrets or connection strings.
Reporting a vulnerability
Please report vulnerabilities privately through GitHub private vulnerability reporting for envtie-core. Do not open public issues for security problems. We aim to acknowledge reports within two business days and to share a remediation plan within ten.