Skip to content

Security

This page covers how SkyPortal keeps secrets away from the model and out of chats, what it checks before SARA's replies reach you, and how API credentials and two-factor authentication work. For who may run what, see Approvals and policies.

Secret redaction

SkyPortal looks for secrets in command output, files and messages, and replaces them before they reach the model or are stored, and before chat messages reach your browser. The live terminal is the exception: it shows you the original output.

What it finds:

  • API keys from Anthropic, OpenAI, GitHub (ghp_, gho_, ghu_, ghs_, ghr_), AWS (access key IDs), Slack (xox…), Stripe (live keys) and Google (AIza…);
  • assignments such as api_key=, secret_key= and token= with values of 20 characters or more, and password=, passwd= or pwd= with 8 or more;
  • passwords in PostgreSQL, MySQL, MongoDB and SQL Server connection strings, and credentials embedded in URLs (https://user:password@...);
  • JWTs, Authorization: Bearer headers, private key blocks (PEM and PGP) and the credential fields of kubeconfigs.

What you see instead:

Found Shown as
A private key [REDACTED PRIVATE KEY]
A standalone token [REDACTED <type>], for example [REDACTED github_personal_token]
An assignment The name stays: API_KEY=[REDACTED]
A connection string postgres://user:[REDACTED]@host/db

Where it applies:

  • command and tool output, before SARA's model reads it;
  • every chat message SkyPortal stores or sends to your browser, including saved terminal output;
  • text files you upload, before they are stored and indexed;
  • Kubernetes state and logs collected from your clusters;
  • the parameters recorded in the audit trail.

Limits:

  • Certificates and IP addresses are not redacted.
  • A value in a .env file is only redacted when it matches one of the patterns above.
  • Images you upload are not scanned.
  • The live terminal shows you the original output.
  • Don't paste secrets into chat messages.

Reply screening

Every reply from SARA is checked before it is saved or shown to you:

  • If it contains a secret, the secret is redacted and the reply is delivered.
  • If the secret can't be removed cleanly, for example a truncated private key, the reply is withheld.
  • If the reply appears to reveal SARA's internal instructions, it is withheld.
  • If the check itself fails, the reply is withheld.

A withheld reply is replaced by: "This response was withheld because it appeared to expose internal system information. The event has been logged and the security team notified."

This screening looks for secrets and leaked instructions. It is not a general content filter.

Sensitive files and cluster operations

SkyPortal treats some commands as sensitive because of what they can expose or break.

Sensitive files: reading or changing credential files such as .env, ~/.ssh/, id_* keys, *.pem and *.key files, ~/.aws/, /etc/shadow, shell history and .git-credentials, plus kubeconfigs and the cluster credentials that kubeadm and k3s keep on nodes: ~/.kube/, /etc/kubernetes/, /etc/rancher/, /var/lib/rancher/k3s/server/, admin.conf, super-admin.conf and k3s.yaml. Searches count too: a search for terms like password, secret, private key, API key or token, and any recursive search or find that starts from a directory holding such files, like /, /etc, /root, a home directory or /var/lib/rancher. They always get an approval card, on one host or many, even when a permit list matches or Read-Only Mode is on.

Kubernetes: reading Secrets, changing RBAC, kubectl exec, cp, attach and port-forward, and deleting a namespace, PVC or PV always need a new approval, even when a permit list matches.

Stored credentials

  • SSH credentials, kubeconfigs and two-factor secrets are stored encrypted.
  • API keys, access tokens and agent tokens are stored only as hashes. SkyPortal shows each one once, when you create it.
  • The exception is your account's legacy API key, which is stored in plaintext. See API credentials.

API credentials

Credential Starts with Where you get it Notes
API key sk_ API Keys page (/keys/): Generate key Acts as you, with your permissions. Rotate or revoke it on the same page
Access token skt_ POST /api/v1/tokens/ with an API key Lasts one hour and never outlives its key. Can't create or manage other credentials
Agent token agt_ Agent Tokens page, or SARA in a chat Bound to one cluster or host. Only uploads observability data
Legacy account key No prefix: 64 hex characters API page (/api_documentation_v2/) Every account has one. Acts as you, with your permissions. Doesn't expire

When you confirm the code from skyportalai login in the browser, SkyPortal creates an API key named "Skyportal CLI" for you. It expires after 90 days.

The legacy account key is created with your account and stored in plaintext, so the API page shows it every time you open it. It isn't listed on the API Keys page and can't be revoked. Regenerate API Key on the API page replaces it, and the old key stops working. Use sk_ keys for scripts and integrations, and regenerate the legacy key if it may have been exposed.

Two-factor authentication and API credentials

SkyPortal supports two-factor authentication with an authenticator app (TOTP), plus recovery codes. Set it up at https://app.skyportal.ai/accounts/2fa/totp/activate/.

Enterprise organizations can require it for their whole team. Contact SkyPortal to turn the requirement on. While a member hasn't set it up:

  • the web app sends them to the setup page;
  • every API credential they own is refused: API keys, access tokens and agent tokens get 403 with "MFA enrollment is required before this credential can be used. Enroll at /accounts/2fa/totp/activate/." Agents using their tokens stop reporting.

With the requirement on, web sessions end after 30 minutes without activity or 12 hours in total.

Enterprise organizations can also sign in through SAML or OIDC single sign-on and provision members with SCIM. Contact SkyPortal to set it up.