Security#

How rickub protects your account, how to protect it yourself, and where to report anything that looks wrong.

Harden your account#

Three settings carry most of the weight, all under Settings:

• Two-factor authentication — a TOTP authenticator app plus recovery codes. Turn it on under Settings → Two-factor auth; store the recovery codes somewhere that is not the phone generating the codes.
• A session inventory — Settings → Sessions lists every signed-in browser with its device and IP. Sign out anything you do not recognize.
• Narrow tokens — hand out Read-only tokens to anything that only looks: CI status dashboards, code-reading agents, mirror pulls. A read-only token cannot push or change anything, so its leak is an inconvenience rather than an incident.

What a password reset revokes#

A password reset is the strong door — it assumes someone else had your password and revokes everything it could reach: all sessions, every personal access and OAuth-minted token, every registry token and the short-lived credentials minted from them. SSH keys are deliberately kept and listed for review. The full story, and the after-recovery checklist, is on Account recovery.

Verify what you fetch#

• Commit signatures — a green Verified badge means the commit is GPG-signed with a key registered on the author's account, and the committer email matches it. Set your own up in Verified commits (GPG).
• The SSH host key — the docs show rickub's live ed25519 fingerprint wherever you first set up SSH, so the first connection is verifiable instead of trust-on-first-use. See Authentication.
• Webhook payloads — every delivery is HMAC-signed with your webhook's secret; verify X-Rickub-Signature-256 before trusting one. See Webhooks.

Organization protections#

On the plans that include them: SSO enforcement (organization access requires completing an SSO sign-in per session, and personal access tokens are refused for that org's resources), an audit log of security-relevant actions, and SIEM forwarding of audit events to your own systems. Owners configure all three from the organization's settings; see Authentication → SSO.

Reporting a vulnerability#

Found something that looks like a security problem — in rickub itself, or in how your data is handled? Please tell us before telling anyone else: the security page has the disclosure process and everything about how rickub runs its own security, from where the data lives to how incidents are handled. Please do not open a public issue for a suspected vulnerability.