[{"data":1,"prerenderedAt":350},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":9,"body":141,"description":343,"extension":344,"meta":345,"navigation":346,"path":8,"seo":347,"stem":348,"__hash__":349},"docs\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust.md",{"type":142,"value":143,"toc":334},"minimark",[144,149,153,162,166,169,172,176,179,246,253,270,273,277,293,323,327],[145,146,148],"h2",{"id":147},"secret-values","Secret values",[150,151,152],"p",{},"Keep secret values in a secret store, not in project YAML. Plans and status\noutput show names and revisions rather than values. Use hidden CLI prompts or\nstdin when entering credentials.",[150,154,155,156,161],{},"Containers still need access to the secrets they use. A host or container-engine\nadministrator can inspect those values. Environment delivery and mounted secret\nfiles are not protection against a compromised host. See\n",[157,158,160],"a",{"href":159},"..\u002Fsecret-delivery","secret delivery",".",[145,163,165],{"id":164},"resources-and-plans","Resources and plans",[150,167,168],{},"mm labels the resources it creates and checks those labels before updating or\nremoving them. It does not adopt an existing resource just because its name\nmatches. When a plan's inputs change, mm requires a new review.",[150,170,171],{},"Missing permissions, unsupported features, or unclear ownership stop the\noperation. mm does not silently switch runtimes or fall back to unrestricted\nshell access.",[145,173,175],{"id":174},"remote-access","Remote access",[150,177,178],{},"Three layers decide every remote request:",[180,181,182,198],"table",{},[183,184,185],"thead",{},[186,187,188,192,195],"tr",{},[189,190,191],"th",{},"Layer",[189,193,194],{},"Lives in",[189,196,197],{},"Decides",[199,200,201,217,232],"tbody",{},[186,202,203,207,214],{},[204,205,206],"td",{},"Host policy",[204,208,209,213],{},[210,211,212],"code",{},"\u002Fetc\u002Fmm\u002Fhost.yaml",", root-only",[204,215,216],{},"Which projects and environments run here, ceilings, break-glass keys, exceptions",[186,218,219,222,229],{},[204,220,221],{},"Project access",[204,223,224,225,228],{},"The repo's ",[210,226,227],{},"users:"," key",[204,230,231],{},"Who may do what in each environment",[186,233,234,237,243],{},[204,235,236],{},"Session",[204,238,239,240],{},"SSH key → relay → ",[210,241,242],{},"mmd",[204,244,245],{},"Identity: the key that authenticated",[150,247,248,249,252],{},"Whatever reaches the users file on a deployed commit is trusted, so protect the\nbranches an environment deploys from (",[210,250,251],{},"deploy-from","). The host still caps it:\naccess never exceeds the host ceiling, and Compose features that would reach the\nhost (privileged containers, host namespaces, devices, and similar) are refused\nunless the host policy allows them for one service.",[150,254,255,256,258,259,262,263,265,266,161],{},"Developers reach ",[210,257,242],{}," through one locked ",[210,260,261],{},"mm"," SSH account that can only start\nthe relay: no shell, PTY, forwarding, or file transfer, and no engine socket.\n",[210,264,242],{}," fetches deployed commits from the origin pinned in the host policy and\nnever accepts project files from a client. See\n",[157,267,269],{"href":268},"..\u002Fremote-access","remote access",[150,271,272],{},"After a disconnected remote change, inspect status and audit history before\nretrying: the operation may have completed even if the response was lost.",[145,274,276],{"id":275},"agent-access","Agent access",[150,278,279,280,284,285,288,289,292],{},"AI agents use the ",[157,281,283],{"href":282},"..\u002Fmcp","MCP server",". The project's reviewed ",[210,286,287],{},"agents:","\nblock sets what an agent may do in each environment; the default is ",[210,290,291],{},"view",".\nAn action outside the grant is not performed: the agent receives the command\nfor the user to run.",[294,295,296,303,316],"ul",{},[297,298,299,300,302],"li",{},"A remote host enforces the block itself. The MCP server connects only with\na separate agent key, and the host gives that key the user's access limited\nby the ",[210,301,287],{}," block of the deployed commit. A local edit cannot widen it.",[297,304,305,306,309,310,312,313,315],{},"On the user's machine the block applies only after the user trusts it with\n",[210,307,308],{},"mm agent trust",", so an agent that edits the block gets ",[210,311,291],{},". ",[210,314,261],{}," also\nrefuses to run directly when a coding tool's environment variables are set.\nBoth stop an agent that follows instructions. Neither contains an agent with\nan unrestricted shell, which can call the container engine or read a key\nfile that is not a security key.",[297,317,318,319,322],{},"Changes require a current plan and a short-lived, single-use review token.\nSecret values, port forwards, an interactive shell, and edits to the users\nfile are not available through MCP. ",[210,320,321],{},"mm_exec"," output is not redacted.",[145,324,326],{"id":325},"report-a-vulnerability","Report a vulnerability",[150,328,329,330,161],{},"Use the repository's private security advisory flow. Include the affected\nrevision, impact, and reproduction steps without live credentials. See the\n",[157,331,333],{"href":332},"..\u002Fproject\u002Fsecurity","security policy",{"title":335,"searchDepth":336,"depth":336,"links":337},"",2,[338,339,340,341,342],{"id":147,"depth":336,"text":148},{"id":164,"depth":336,"text":165},{"id":174,"depth":336,"text":175},{"id":275,"depth":336,"text":276},{"id":325,"depth":336,"text":326},"What mm protects, who can access secrets, and where permissions are configured.","md",{},true,{"title":9,"description":343},"docs\u002Farchitecture\u002Fsecurity-and-trust","hwxjvSnakQxAmDggM3cVoeFtCZGJol5mGEK14eBLfKc",1794512546199]