Docs
Security
Acahti's trust boundaries. One public gateway, private kernels, agents that authenticate as people, and secrets that never come back out.
One public surface
An instance exposes a single gateway. Everything else stays private.
| Public, through the gateway | Private |
|---|---|
Web app (/ui, session cookie) |
Forgejo's own web UI and /api/v1 |
MCP (/mcp, OAuth) |
Woodpecker's UI and /ci |
REST and CLI (/acahti/v1) |
Woodpecker's gRPC port for Runners |
Git over HTTPS (/<org>/<repo>.git) |
PostgreSQL |
Package registries (/api/packages) |
The kernels' paths answer 404 through the gateway. Product content (docs, skills) is not served by instances at all; it lives on this site.
Credentials
| Credential | Works for | Notes |
|---|---|---|
| Access token | MCP, REST, CLI, Git, packages | From OAuth (MCP, acahti auth login) or the avatar menu. Represents the member. Deleting it revokes it |
| Account password | Web login, Git, packages, REST over HTTP Basic | Never sent by the CLI. Not accepted by MCP |
| Session cookie | Web app, MCP, REST | Browser only |
An SSH key is not a credential anywhere in Acahti. Tokens carry the member's full authority; per-task delegation is not part of this release. Agents are told never to paste tokens into chat.
Secrets
- Pipeline secrets live on the control plane. Values are never listed or returned; there is no read API.
- Only org admins (org scope) and repository admins (repo scope) can list names or write values.
- A pipeline step receives a secret only when its YAML names it.
- Credentials for outside systems (registries, clusters) stay as named secrets, never in git or
with:.
Execution
- The control plane and the Runner are separate hosts. Untrusted pipeline code never runs next to the control plane's data.
- The gateway expands official pipes before a job starts; the Runner executes what it receives with the injected environment.
- The Runner reaches the gateway over your LAN. Never publish the gRPC port to the internet.
Merge gate
pr_mergesucceeds only when the newest pipeline on the head SHA is green.- Branch protection, repository access, and team membership stay explicit human policy.
Limits
- A green pipeline means the configured checks passed, not that the software is free of defects.
- People still approve gated deploys (
deploy_approve) and manage membership.
Reporting a vulnerability
Use private vulnerability reporting on the repository, with the affected version and a minimal synthetic reproduction. Do not put credentials or exploit details in public issues.
For agents: security.md