Security at Magnifik

GitHub OAuth state is short-lived and verified before callback processing. Access tokens are encrypted at rest and scoped to the connected account. Project API reads and mutations verify ownership.

GitHub webhook payloads are authenticated with a project-level secret. Delivery identifiers and database constraints prevent duplicate work from creating duplicate preview records or queue jobs.

Environment variable values are encrypted and never returned by list APIs. Build and runtime log responses redact known secret values.

Deployments are immutable. A domain can point only to a deployment from the same project, and production changes update DomainMapping instead of mutating or rebuilding the deployment artifact.

Review third-party dependencies, restrict repository access, rotate exposed application credentials, and inspect pull requests before rebuilding public-repository previews.