Product
Credentials
Encrypted at rest, scoped per job to exactly the purposes the steps in that job declare, and never returned by any API — to anybody, including you.
Scoped to the job, not to the machine
A job gets an App Store Connect key only if a step in it declares it needs one. The material is delivered per job, in the format the agent asks for — keychain, file, environment — and is not left where the next job can read it.
Logs are scrubbed before they leave the machine, not after they arrive. The difference matters on a self-hosted deployment where the log path and the control plane are different trust boundaries.
Bound to the store account, because Apple makes that necessary
Apple caps distribution certificates per team. A per-project credential model is not merely wasteful under that cap — it is impossible. So credentials bind to the store account and are shared across the projects that ship through it, which is also what makes moving a project between accounts a tractable operation.
A blast radius you can look at
For any credential: every app it can sign, every project that would stop shipping if it were revoked. That view exists because the question somebody asks at the worst moment is “what breaks if I rotate this”, and the answer should not require reading a database.
What this part refuses to do
Each of these could be built, and each would make the product worse.
- Showing you a secret twice
- A minted secret — an invitation token, an API key, a runner enrolment token — is returned exactly once. Only its hash is stored, so there is no route that could show it again, and the console says so rather than implying otherwise.
- A wildcard grant for an adopted lane
- A fastlane lane declares the credential purposes it uses, and that list is the entire grant. A lane that needs a key it did not declare fails loudly with the reason, which is better than one that silently receives everything.
- Auto-issuing an Apple distribution certificate
- Under the per-team cap, issuing one when the team is full requires revoking another — which breaks signing for every app on that team, including apps Conductor does not manage.