Security model

DevOpsPad holds credentials for production databases and clusters, so it is built to read by default, keep secrets out of files and out of the UI, and make every write explicit.

Secrets

Database passwords, SSH passwords, key passphrases and AI API keys are stored in the OS credential store under the devopspad service. Each has its own entry.
Saving a secret requires a working keychain. If the keychain is unavailable, saving fails. There is no plaintext fallback.
Saved secrets are never returned to the interface. A blank password field keeps the existing secret.
Connection metadata is written atomically to workspace.json with owner-only file permissions. If writing metadata or the keychain fails, both are rolled back together.
SSH private keys stay in the files you select; DevOpsPad stores the path, not the key.

How secrets are stored

Read-only access

Engine	How reads are enforced
MySQL	Queries run in a server-side `READ ONLY` transaction, which rejects `INSERT`, `UPDATE` and `DELETE`. DDL such as `DROP` commits implicitly in MySQL and is not reliably blocked, so use a `SELECT`-only account.
ClickHouse	HTTP interface with `readonly=1` and result limits
Redis	An allow-list of 20 read commands (`GET`, `SCAN`, `HGET`, `INFO` and similar)
MongoDB	Only `find` with filter, projection, sort, skip and limit
Kafka	Metadata only: topics, partitions, leaders, replicas
Kubernetes / K3s	The query adapter exposes no mutations; RBAC still applies

Application read modes supplement server permissions; they do not replace them. Use read-only database accounts and least-privilege cluster credentials. Set up least-privilege accounts.

Network paths

SSH tunnels verify host keys against known_hosts or a SHA256: fingerprint you supply. Unknown or changed keys fail; nothing is trusted automatically.
When SSH fails there is no fallback to a direct connection.
Forwarding uses SSH channels without opening a local listening port.
TLS hostname verification is preserved through the tunnel. Kubernetes keeps the kubeconfig CA, client certificates and server name.
Exec-based kubeconfig authentication plugins are rejected rather than executed.

Verify SSH host keys

Cluster writes

The Infra console is the only part of DevOpsPad that changes anything. Image releases, scaling, restarts and rollbacks share one path:

Plan. A server-side dry-run produces a plan showing the target, current state and change. Plans expire after 10 minutes.
Confirm. Nothing happens until you confirm the plan.
Lock. DevOpsPad takes a per-target Kubernetes Lease so two people cannot release the same Deployment at once.
Check. If the Deployment's UID or resource version changed since the plan, the release stops and asks you to plan again.
Verify and record. It waits for the rollout (bounded to 180 seconds) and writes a local record. A lost response is reported as uncertain, never retried automatically, and a failed rollout is not rolled back automatically.

Release safeguards · Release an image

AI assistant

Requests go only to the provider you configure. HTTPS is required except for loopback addresses, and redirects are not followed.
Each request contains your prompt and the engine name. Resource names are sent only if you turn on Include resource names.
Credentials and result rows are never included. Pod logs are not sent to AI.
Suggestions are inserted into the editor and never run automatically.

Exactly what is sent to the AI provider

Releases of DevOpsPad itself

macOS builds are signed with a Developer ID certificate and notarized by Apple in CI. Each release includesSHA256SUMS. See Download.