Security best practices

Security on a PaaS is shared between the platform and your team. Infralane provides customer controls; you remain responsible for source code, application behavior, credentials, access decisions, and the data your application processes.

Protect accounts

• use unique passwords and a trusted password manager;
• enable two-factor authentication;
• do not share accounts;
• grant the least-privileged workspace role;
• review privileged members and pending invitations regularly;
• remove access promptly during offboarding.

Protect secrets

Use environment-variable value fields for runtime secrets when appropriate. Never place secrets in:

• repository or image URLs;
• application, project, pool, or volume names;
• descriptions;
• build or start commands;
• source code or committed configuration;
• logs, screenshots, or support messages.

Rotate a secret immediately if it may have been exposed.

Protect source integrations

Connect GitHub only to the intended workspace and grant access only to required repositories. Review access when applications are retired or team ownership changes. Do not embed personal access tokens in Git URLs.

Release safely

• use versioned image tags and controlled branches;
• make small, reviewable configuration changes;
• remember that each saved settings section deploys;
• verify deployment status, logs, and important user paths;
• maintain a tested application-level backup and recovery plan;
• document production changes and incidents.

Use logs and terminal safely

Design applications to redact protected values from logs. Download and share only reviewed excerpts. Treat terminal access as privileged, verify context before use, and make durable fixes through source or supported settings rather than manual instance changes.

Handle customer data

Collect only the data your application needs. Apply appropriate access control, retention, encryption, deletion, and regulatory practices for your organization and users. Do not infer a compliance certification from use of the platform; rely only on formally published Infralane statements and your own assessment.

Safe support request

Include resource names only if they contain no sensitive information, the deployment or order ID, approximate time, status, redacted error, and steps already tried. Never send passwords, private keys, access tokens, MFA codes or setup keys, secret environment values, payment PINs, or unreviewed customer data.