C
← Home

Operational credentials

Which kinds of credentials this repo touches, where they live, and what they can do. No values are listed here — this page exists so a reader (or security reviewer) can understand the credential surface without having to read the code.

Disclosure principle

This repo never stores credentials in files that get committed. All secrets live in the host environment at runtime:.env files are gitignored, GitHub Actions secrets never leave runner memory, Render service config hides env-vars from the public dashboard. If a value appears in git log or a PR diff, that's a leak — see SECURITY.md.

GitHub Personal Access Token (classic)long-livedexpires: manual rotation
Location
host machine — `coral` CLI environment
Scopes / capabilities
reporead:userread:org
Used for
  • github/* probes — public repos only
  • verification that PATs work at all
None of the tokens are committed. They live in the host shell env at probe time only.
GitHub App JWT (preferred for App-only endpoints)session tokenexpires: 1 hour per signing
Location
generated on demand from a GitHub App private key (not yet wired for probes)
Scopes / capabilities
contents:readmetadata:readmembers:read
Used for
  • github.app, app_installations, app_hook_* — currently 401-failing on PAT
Wired in scripts but not provisioned yet — see F003 finding.
Coral CLI workspace = defaultlong-livedexpires: config-driven
Location
host machine
Scopes / capabilities
workspace-scoped (whatever sources are configured)
Used for
  • all `coral sql <query>` invocations from scripts/probe_*.py
Workspace selection via --workspace default; no network credentials in transit beyond the per-source tokens above.
Render API key (for `render deploys create`)session tokenexpires: 1 year
Location
host machine, in $RENDER_API_KEY
Scopes / capabilities
deploylogs
Used for
  • Render service provisioning + redeploys
Used only by scripts/render-deploy.sh. Revoke from dashboard.render.com if compromised.
Dependabot / GitHub Actions ephemeral tokenssession tokenexpires: per-job
Location
GitHub Actions runner only
Scopes / capabilities
contents:write (PRs only)
Used for
  • Dependabot PRs and the CI matrix
Never touches Coral CLI.
What we don't do
  • We don't store credentials in git, even ephemerally.
  • We don't pass tokens through CI logs (Render shows env-vars redacted; GitHub Actions uses masked secrets).
  • We don't run probes that require credentials we don't have — those probes land in auth.app_jwt_required with a “not probeable on this token” note.
  • We don't log full request/response bodies for authenticated endpoints — first row + sample counts only.