Credentials never reach the code the agent runs.
An agent writes code and then runs it: tests, builds, package installs. Nightsquire treats all of that as untrusted, and is built so that a step that goes wrong cannot take your tokens with it.
The step holds a placeholder. The gateway holds the key.
Controller
- Plans runs and hands out steps
- Keeps secrets encrypted with your organisation's own key
- Never runs your code
Step container
The agent, your code, your tests. Internal network only: the gateway is its one way out.
GITLAB_READ_TOKEN=hstep_7f3a_…
MODEL_TOKEN=hstep_7f3a_…
Egress gateway
- Swaps the placeholder for the real credential
- Checks the destination against your policy
- Records every host, allowed or refused
allowed hosts only
The internet
Your GitLab
only the routes a step needs
Model provider
Nightsquire AI or your own provider
Package registries
npm, PyPI, Docker Hub and the like
A placeholder only works for its own step and its own route. The GitLab placeholder is useless against the model API and the other way round. Once the step ends, it is worthless.
Six rules, enforced in code.
Separate jobs, separate secrets
Steps that run the model and your code never get GitLab write access. Steps that push and comment never run your project's code. Commits travel between them as git bundles.
Placeholders, not tokens
Every step gets its own random placeholder per route. The real credential and the provider's address never enter the container, not even through /proc.
Hardened, throwaway containers
One container per step, removed afterwards. Non-root, all capabilities dropped, no privilege escalation, read-only root filesystem, CPU, memory and time limits. Docker builds run in a sandboxed sidecar, never on the host's socket.
A network you decide
Open, or an allowlist built from what your runs actually reached. Cloud metadata, link-local addresses and the executor's own networks are always refused, and so are private ranges unless you exempt one on your own executor. No TLS interception.
Hosts that only connect out
Executors open no inbound ports and only connect out. You can let Nightsquire manage the host firewall: every change rolls back by itself unless the executor reports in through the new rules.
Least privilege in GitLab
The bot gets Developer on the projects you enable, pushes only to its own branches, creates issues only when asked, and never merges. Runs may read other projects they need, such as CI includes, components and submodules; where the bot lacks access, an Owner or Admin can grant it Reporter, never more. A run reads only what the person who started it can read: Nightsquire checks each such read against their GitLab access first and refuses the rest.
Kept apart, kept as long as you say, deleted when you ask.
Your code is checked out and run on your executors. What passes through Nightsquire, such as run state between steps, logs and transcripts, is stored for the retention period you set.
- Isolation
- Row-level security in the database for every organisation, checked at startup and by a cross-tenant test suite.
- Project access
- Owners and Admins see every project. Members and Viewers see only the projects their own GitLab account can read, by a check never more than 15 minutes old.
- Encryption
- Tokens and keys are encrypted with a key per organisation.
- Retention
- Yours to set, within limits. By default logs, transcripts and run outputs go after 90 days, webhook payloads after 30 and the audit log after a year.
- Export and deletion
- Owners can export the configuration, members, projects, run history and audit log; logs, transcripts and secrets stay out. Deleting the organisation takes effect after a 7-day grace period and destroys its key.
- Audit
- Sign-ins, settings, grants and every config change are in an audit log you can read.
- Location
- Built and run by an Irish business, hosted only in the EU: the control panel on netcup in Germany; managed executors, Nightsquire AI and email on Scaleway in France. Data sovereignty
Found a vulnerability?
Tell us at security@nightsquire.dev before you tell anyone else. We reply within 2 business days and keep you posted until it is fixed.
Questions from your security team?
Send them to security@nightsquire.dev. Or leave your email and we'll tell you when Nightsquire opens.