Hub
Owns identities, policy, encrypted secrets, audit events, repositories, build state, and deployment intent. The hub does not mount the host Docker socket.
Security and trust
Production automation should be constrained before it is clever.
This page describes the implemented ReaperCI security model and the assurance work still required before managed GA. It is not a certification claim.
Control boundaries
Builds
Managed tenants receive isolated rootless BuildKit stacks, volumes, networks, encryption keys, quotas, and backup sets. BYO workers remain customer-owned compute.
Servers
The managed connector enrolls once, connects outbound over mTLS, rotates certificates, rejects replay, and exposes only typed, allowlisted operations. Direct SSH remains a self-hosted option.
Agents
CLI, MCP, and API actions use scoped service accounts. Production requests remain subject to environment approvals and every action is attributed.
Deployment safety
- Environment-scoped secrets and tokens
- Protected production approvals
- Health checks with configurable failure thresholds
- Immutable Docker image evidence and exact-image rollback
- Drift reporting and last-known-state timestamps
- Append-only audit events and secret masking
Managed data protection
Managed backups stream to a tenant-scoped S3-compatible key, record size and SHA-256, and require explicit server-side encryption. Restore hydrates to a random mode-0600 file and verifies integrity before stopping the tenant hub. Production bucket, KMS, object-lock, and separate-host restore drills remain launch gates.
Current assurance status
Implemented
Required unit, integration, browser, secret-scan, dependency-audit, multi-architecture image, SBOM, image-scan, backup/restore, and BuildKit/registry gates.
Before managed GA
Independent security review, production infrastructure review, live provider and disaster-recovery drills, legal review, trademark clearance, and closure of all critical/high findings.
Report a vulnerability
Please follow the coordinated vulnerability disclosure policy and email security@reaperci.dev with impact, affected component, reproduction steps, and a safe contact method. Do not include customer secrets or exploit public systems.