Security
The boundaries Towbar treats as product behavior.
Private by default
There is no signup endpoint. Bootstrap creates one owner, password hashing uses Argon2id, sessions are revocable, and authorization codes are short-lived and single-use.
Least privilege
The GitHub App requests read-only repository metadata and contents. AWS credentials should resolve only named secrets. SSH uses a dedicated unprivileged user with the narrowly required sudo and Docker access.
Fail closed
Unknown manifest fields, duplicate IDs, conflicting domains, untrusted host keys, failed credential checks, unhealthy candidates, and failed HTTPS verification all stop before traffic promotion.