jb/paseo
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(hub): document workflow security boundaries (#3032)

Browse Source 
* docs(hub): add security guidance for workflows

* docs: register Hub security guide
This commit is contained in:
Mohamed Boudra
2026-08-08 17:22:09 +02:00
committed by GitHub
parent 375d1d6fb8
commit 3d420720c5
9 changed files with 321 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public-docs/hub/concepts.md
+2
View File
@@ -61,4 +61,6 @@ If activation fails, Hub keeps the previous active revision. The Configuration t
Triggers require a non-empty `from_users` allowlist for externally sourced events. Protect the configuration repository because anyone who can change the active configuration can choose which connections, daemons, and agent capabilities a project uses.
These controls do not sandbox the agent or make input safe. See [Hub security](/docs/hub/security) for the host boundary, provider-native policy, and defense-in-depth guidance.
GitHub-triggered steps receive a scoped GitHub credential for the triggering repository. Slack and Discord do not implicitly choose a GitHub connection.