Station guide / 03
Security & credentials
What Defang stores, what stays on your Station, and the boundaries that keep one account’s work away from another’s.
Two systems, two kinds of data
Defang’s systems
Account identity, signed sessions, Station configuration, lifecycle status, job state, and an event log.
Your Station
Repository files, terminal sessions, agent configuration, and credentials created by provider CLIs.
Every Station belongs to one account
That is checked on every request, against your signed-in session rather than anything the browser sends. There is no identifier you or anyone else can pass to reach another account’s Station.
Sessions and passwords
BetterAuth owns password hashing and session cookies. Cookies are HTTP-only and signed. Changing your password signs out every other session, which is the thing to do first if you think someone else has been in your account.
Lifecycle safety
- Creation, retries, and destruction become uniquely keyed durable jobs.
- Lifecycle revisions prevent stale work from overwriting a newer decision.
- Each visible transition is appended to the Station event log.
- Destruction requires typing the Station name exactly.
Deleting an account
Destroy your Station first, then type your email and, where you have one, your password. The server refuses to delete an account while a Station is still running, so no machine is left behind with nobody to own it. Deleting your account then removes your Station and everything we hold about it.
Security promise
Defang never receives your Anthropic and OpenAI credentials. They are written on your Station, by the provider’s own CLI.