Security

Native Git and OpenSSH, current permissions, and a separate public web process.

Process boundaries

The policy daemon owns users, keys, permissions, audit and repository lifecycle. Native OpenSSH authenticates personal keys; a restricted dispatcher checks current policy before executing native Git. The fixed login entry point and trusted hooks cannot be replaced by Git workers.

The optional Rust/Axum web service runs as a separate unprivileged OS identity. It holds no operator token, SMTP secret, policy database or repository filesystem access. Its private Unix connection accepts scoped browser sessions and checks the actual peer UID. Management remains private and authenticated; there is no public operator API.

Browser authentication

Accounts are administrator-created, with enrolled email and single-use, rate-limited OTPs. Codes and browser credentials are stored as hashes. Sessions expire after twelve hours and check enabled/version/deny state and current repository role on each request. Account edits and sign-out revoke access.

The essentials update revokes the prior cookie on successful reauthentication, adds HTTPS HSTS, and invalidates restored browser sessions and pending codes during full-instance recovery.

Browser request protections

Production cookies are host-only __Host- cookies with Secure, HttpOnly, SameSite=Lax and Path=/. Mutations require the exact configured Host and Origin plus CSRF protection. Forwarded headers cannot choose the application's origin or authority.

Responses are not cached. A restrictive CSP excludes third-party assets, inline scripts/styles and framing. Templates escape policy values; read-only browsing sanitizes Markdown and never activates repository content. The console loads no remote fonts or scripts.

Repository and destructive actions

Repository and service administration remain separate. Versioned edits reject stale forms; durable operations use stable idempotency. Permanent purge requires service-admin authority and exact-name confirmation, then drains work before deletion. UUID/name/route tombstones and revoked key fingerprints stay reserved.

Operational limits

A compromised mailbox or browser can exercise that user's current permissions. This is passwordless sign-in, not a second authentication factor. Root or policy-daemon compromise is outside this isolation boundary. Data already downloaded cannot be recalled after revocation.

Keep OS Git/OpenSSH patched, verify distinct UIDs and effective systemd/SSH policies, and test the real storage boundary, public TLS and mail delivery. Encrypt instance backups: they contain secrets and historic revocation state. See the detailed security model and essentials review.

Deployment verification

The existing-service deployment at git.codepilot.com verified trusted HTTPS, redirects, Secure/HttpOnly/SameSite cookie attributes, CSP and HSTS. Its distinct web UID cannot access repository, policy, SMTP or operator data or the management socket. The audited schema upgrade preserved existing identities, permissions, denies, routes and retained refs; Git and administrative SSH policies were preserved.

SMTP delivery was accepted and marked delivered. A complete authenticated public browser journey is still awaiting verification. TLS cache persistence across a restart passed; certificate renewal has not been independently rehearsed. See the deployment summary for the remaining installer and recovery acceptance boundaries.