Security
Security
Secure Git access, signed commits, CLI credentials, bot tokens, and account sessions.
Trylle uses separate credentials for Git transport, commit identity, API access, and automation identities.
| Credential | Purpose | Where to manage |
|---|---|---|
| SSH public key | Git clone, fetch, and push over SSH | Settings → SSH keys or try ssh-key |
| GPG public key | Verify signed commits and tags | Settings → GPG keys |
| CLI key | User API access from try | Settings → CLI |
| Bot token | API access as a bot identity | Bot settings or try bot token |
| Actions secret | Runtime workflow secret | Repository or organization Actions settings |
Baseline practices
- Protect private SSH and GPG keys with passphrases.
- Use a distinct CLI key per device or automation boundary.
- Never commit CLI keys, bot tokens, provider keys, or Actions secrets.
- Rotate credentials after accidental disclosure and remove unused keys promptly.
- Review active sessions and notification alerts for unexpected account activity.
Continue with SSH keys, GPG keys, or the broader credential guide.