Overview

Stashbase is built so people and coding agents get the access they need without secrets spreading across the tools your team uses. The platform combines an enforced agent boundary with workspace isolation, layered encryption, and scoped access control.

Security principles

• Agents get access, not credentials
• Least privilege by default
• Workspace isolation
• Layered encryption architecture
• Secure-by-default integrations
• Practical developer security

Agent boundary

Coding agents run in a native or Docker sandbox and never receive secret values. They get short-lived placeholders, and the Agent Proxy injects a real value only when a request matches the profile's policy for that credential. With the Docker sandbox, the proxy is the agent's only network route, so the agent cannot bypass policy or reach unapproved hosts.

See Agents for profiles, sandboxes, and audit logs.

Architecture

Stashbase uses a layered security architecture designed around encryption isolation, scoped access control, and secure integration flows.

See the Architecture page for more details about:

• encryption hierarchy
• integration isolation
• authentication and session security
• infrastructure security
• logging and auditability

Authentication and access control

Stashbase supports:

• OAuth authentication
• MFA
• secure session handling
• scoped API keys
• environment-level permissions
• service accounts

Integrations security

Integration credentials are encrypted separately from application secrets using isolated encryption contexts and provider-specific security flows.

Secret scanning and remediation

Stashbase supports repository and secret scanning workflows designed to help identify exposed or hard-coded secrets and support remediation workflows.

Vulnerability disclosure

We appreciate responsible security research and welcome reports of potential vulnerabilities.

If you believe you have discovered a security issue or vulnerability, please contact: support@stashbase.dev

Please include:

• affected systems or endpoints
• reproduction steps
• proof of concept if available
• impact assessment

We aim to acknowledge reports promptly and work collaboratively on responsible disclosure.

Depending on the severity and quality of the report, Stashbase may offer discretionary rewards for valid security findings.

Contact and support

If you have any questions about security practices, need assistance with a security issue, or want to report a potential vulnerability, you can contact us at: support@stashbase.dev