# Security

## One public surface

An instance exposes a single gateway. Everything else stays private.

| Public, through the gateway | Private |
|---|---|
| Web app (`/ui`, session cookie) | Forgejo's own web UI and `/api/v1` |
| MCP (`/mcp`, OAuth) | Woodpecker's UI and `/ci` |
| REST and CLI (`/acahti/v1`) | Woodpecker's gRPC port for Runners |
| Git over HTTPS (`/<org>/<repo>.git`) | PostgreSQL |
| Package registries (`/api/packages`) | |

The kernels' paths answer 404 through the gateway. Product content (docs, skills) is not served by instances at all; it lives on this site.

## Credentials

| Credential | Works for | Notes |
|---|---|---|
| Access token | MCP, REST, CLI, Git, packages | From OAuth (MCP, `acahti auth login`) or the avatar menu. Represents the member. Deleting it revokes it |
| Account password | Web login, Git, packages, REST over HTTP Basic | Never sent by the CLI. Not accepted by MCP |
| Session cookie | Web app, MCP, REST | Browser only |

An SSH key is not a credential anywhere in Acahti. Tokens carry the member's full authority; per-task delegation is not part of this release. Agents are told never to paste tokens into chat.

## Secrets

- Pipeline secrets live on the control plane. Values are never listed or returned; there is no read API.
- Only org admins (org scope) and repository admins (repo scope) can list names or write values.
- A pipeline step receives a secret only when its YAML names it.
- Credentials for outside systems (registries, clusters) stay as named secrets, never in git or `with:`.

## Execution

- The control plane and the **Runner** are separate hosts. Untrusted pipeline code never runs next to the control plane's data.
- The gateway expands official pipes before a job starts; the Runner executes what it receives with the injected environment.
- The Runner reaches the gateway over your LAN. Never publish the gRPC port to the internet.

## Merge gate

- `pr_merge` succeeds only when the newest pipeline on the head SHA is green.
- Branch protection, repository access, and team membership stay explicit human policy.

## Limits

- A green pipeline means the configured checks passed, not that the software is free of defects.
- People still approve gated deploys (`deploy_approve`) and manage membership.

## Reporting a vulnerability

Use [private vulnerability reporting](https://github.com/benchyard/acahti/security/advisories/new) on the repository, with the affected version and a minimal synthetic reproduction. Do not put credentials or exploit details in public issues.