Security

Isolation

Every job runs in a fresh container on a fresh machine, and the machine is discarded when the job ends. Nothing from one job is visible to the next; nothing from one customer is visible to another. Caches and artifacts are scoped to the repository that wrote them.

Credentials

Apex never holds a long-lived cloud credential on your behalf. permissions: id-token: write gives a job a short-lived identity token, which the job exchanges for credentials that expire with it. Our own infrastructure follows the same rule: no long-lived keys for people, for CI, or for workloads.

Secrets

A secret is a write-only value. It is read only by the job that needs it, never printed, never stored in a log, never captured in a snapshot. The local-reproduce command names every secret a job used and never includes its value.

The GitHub App

The App asks for the scopes a CI provider needs and no more: checks (read and write), contents (read), metadata (read), pull requests (read). It receives webhooks; it does not poll, and it cannot push.

Reporting a vulnerability

Write to security@apexactions.com. We acknowledge within one business day, keep you informed while we investigate, and credit the report if you want us to. Please do not test against another customer's data.