Skip to content

Security: abrulic/deploykit

Security

SECURITY.md

Security & Privacy

DeployKit is a local command-line tool. It has no backend, no server, and no account. Everything it does runs on your machine and talks directly to GitHub, Fly, and (optionally) Cloudflare on your behalf. There is nowhere for your credentials to be sent to us, because there is no "us" to send them to.

This document explains exactly what DeployKit accesses, where every credential is stored, and how to revoke access — so you can verify these claims rather than take our word for them.

No telemetry

DeployKit collects no analytics, no usage data, and no crash reports. It makes no network requests except the ones you can see: direct API calls to GitHub, Fly, and Cloudflare to do the work you asked for.

What it accesses, and why

Provider How you sign in Why
GitHub OAuth device flow (the "Authorize DeployKit" screen) Create/read repos, set Actions secrets, and open the setup PR. Scopes: repo, workflow.
Fly flyctl login Create Fly apps and issue a deploy token for CI.
Cloudflare (optional) API token you paste Configure DNS for custom domains, if you use them.

The GitHub consent screen shows you these scopes before you approve. repo grants read/write to your repositories (including private ones) — that breadth is required to create repos and manage their Actions secrets and workflows.

Where your credentials are stored

Every credential lives on your machine only. DeployKit never transmits any of them to a DeployKit-controlled server (there isn't one).

  • GitHub token — handed straight to the official GitHub CLI (gh), which stores it in your OS keychain when available, otherwise in ~/.config/gh/hosts.yml. DeployKit does not keep its own copy.
  • Fly token — managed by flyctl in its own local config. The CI deploy token DeployKit generates is written to your repository as the FLY_API_TOKEN GitHub Actions secret (encrypted at rest by GitHub) so your workflow can deploy — it is not stored anywhere else.
  • Cloudflare token (optional) — saved, only if you opt in, to .deploykit/credentials in your repo, with file permissions 0600 and git-ignored by default. You can also pass it via the CLOUDFLARE_API_TOKEN environment variable and have nothing written to disk.

How to revoke access

  • GitHub: Settings → Applications → Authorized OAuth Apps → DeployKit → Revoke. To also clear the local token: gh auth logout.
  • Fly: flyctl auth logout, and revoke the FLY_API_TOKEN secret from your repo's Actions secrets if you no longer want CI to deploy.
  • Cloudflare: delete the token in the Cloudflare dashboard, and remove the .deploykit/credentials file.

How to verify all of this

You don't have to trust this document — you can check it:

  • Read the source. DeployKit is source-available. The auth flow lives in src/auth.ts and credential handling in src/secrets-file.ts.
  • Watch the network. Run DeployKit under a proxy or packet inspector; every request goes to github.com, api.github.com, fly.io, or api.cloudflare.com — never to a DeployKit host.
  • npm provenance. Released packages are published with npm provenance, which cryptographically links the package you install to the exact public commit and CI run that built it.

Reporting a vulnerability

Please report security issues privately via GitHub's private vulnerability reporting rather than opening a public issue. We'll acknowledge your report and work with you on a fix and disclosure timeline.

There aren't any published security advisories