Security Model

Security Model

English · 繁體中文

Credentials

• Passwords are never accepted on the command line. A password can only be typed at a TTY without echo, or replaced by token login, so it never lands in shell history or the process list.
• Tokens live in the operating system keyring and are never written to the config file.
• The keyring key includes both the profile and the API URL, so switching sites never reuses an old token.
• --verbose diagnostics contain only method, path, status code, and elapsed time — no Authorization header, password, or token.

Values that never leak

The following never appear in success output, list results, or dry runs:

• Webhook signing secrets
• Application token auth codes, and callback URLs that carry one
• Project ownership transfer tokens

Retry policy

• Only idempotent GETs are retried automatically, with a bounded attempt count and randomized backoff.
• POST, PATCH, and DELETE are never resent blindly.
• The few endpoints that use GET to enqueue background work — project export, for example — are marked non-idempotent and are not retried either.
• Only 429, 502, 503, and 504 trigger a retry, honouring the server's Retry-After up to 30 seconds.

Writes with an unknown outcome

When a write fails in transit, or its response cannot be decoded, the CLI reports ambiguous_commit (exit code 11) with a message saying the request may have been committed and should be verified before retrying. That is safer than resending, which could duplicate a record.

After deleting a work item or metadata record, the CLI reads it back to confirm it is gone. Comment edits, deletions, and restorations are likewise confirmed by comparing timestamps. When confirmation is impossible, the result is ambiguous_commit rather than an assumption of success.

Optimistic concurrency control

Every mutation carries Taiga's version. On conflict the CLI reports occ_conflict (exit code 6) and stops — it never auto-merges and never overwrites someone else's change. Use --base-version when you need explicit control over the base.

Destructive actions

Without a terminal, delete commands require an explicit --yes or they report confirmation_required (exit code 10). Interactive runs ask. The CLI never skips confirmation because something "looks automated".

File handling

• Downloads are written to a 0600 temporary file, verified, then moved atomically into place, and never overwrite an existing file by default.
• Config files and caches use the same temp-then-rename approach, with 0600 files inside 0700 directories.
• Attachment downloads never send the API bearer token to the media URL.

Transport

TLS verification is always on. There is no flag to disable it.