Security overview

Slipway’s design goal is secure by construction: the safe path is the default one, and the controls that matter are not paywalled.

Principles

1. No long-lived credentials in pipelines. Jobs get a short-lived OIDC identity and federate into clouds and secret managers. See OIDC job tokens.
2. Isolation does not depend on remembering a WHERE clause. Every org-scoped table has Postgres row-level security keyed on the organisation. See Tenant isolation.
3. Secrets are write-only and encrypted with envelope encryption, with BYOK. See Secrets.
4. Everything is auditable. Every mutating action and every deployment decision is recorded, append-only. See Compliance.
5. Provenance for every artifact. Signed SLSA attestations, cosign integration and policy gates. See Supply chain.
6. Runners dial out. There is no inbound path into your network. See Runner security.

Controls at a glance

Area	Control
Authentication	argon2id passwords, TOTP and WebAuthn MFA, OIDC SSO on every plan, SAML and SCIM on Business and above
Authorisation	RBAC with org, project and environment scopes, custom roles (Team+), CEL policy evaluation
Tokens	Hashed at rest, scoped, expiring, constant-time comparison; job tokens are 15-minute OIDC JWTs
Webhooks	Signature verified before the body is parsed; size-limited
Data at rest	Postgres and object storage encrypted by your provider; secrets envelope-encrypted with AES-256-GCM under per-org keys
Data in transit	TLS for all external connections; runners authenticate to the server
Isolation	Postgres RLS by org, per-request app.org_id, unprivileged application role
Execution	Executor isolation (container or pod per job); secrets masked on the runner
Supply chain	Provenance attestations, signature verification gates, SBOM and scanner ingestion
Network	Outbound-only runners; optional NetworkPolicies; IP allowlists per org
Operations	Structured logs with no secrets; Prometheus and OTel; audit streaming

Shared responsibility

Slipway Cloud	Self-hosted
We secure the control plane, database and hosted runners	You secure the infrastructure, keys and backups
You secure your pipelines, secrets hygiene, runner pools and access policies	You also own patching and the master key

Reporting a vulnerability

Email security@slipway.systems (placeholder address; confirm before launch) with details and, if possible, a reproduction. Please do not open public issues for vulnerabilities. We acknowledge reports promptly and credit researchers who want it.

Hardening checklist for organisations

• Enforce SSO and MFA; restrict sign-up to your email domains.
• Use environment-scoped secrets and allowed_pipelines for production credentials.
• Replace stored cloud keys with OIDC federation, binding trust to environment and ref.
• Require approvals and policy gates on production; forbid self-approval.
• Run untrusted pull-request jobs on a separate, ephemeral runner pool with no secrets.
• Pin steps and templates to immutable versions or digests.
• Turn on audit log export and review role bindings periodically.