Security

Security model

SwissKnife is an admin tool with tenant-wide reach, so it's built defensively.

Secrets & tokens

• Client secret is stored only in the OS keychain (Windows Credential Manager / macOS Keychain / Linux Secret Service), and only if you opt in with Remember. It's never written to disk in plain text.
• The access token lives only in the Go backend. It is never exposed to the web frontend — every Graph call is made from Go, and the token is refreshed automatically before it expires.
• Connection profiles store only non-secret fields; the secret is a reference into the keychain.

Destructive-action guardrails

• Actions that can't be undone — wipe, retire, delete user/device/file, reset password, send mail as a user, remove an admin role — require a typed confirmation (you type the target's name), and the backend re-checks it (the UI is never trusted alone).
• Every write/destructive action is written to a local audit log (see the Activity tab): what, on whom, when, and the result.
• A global Read-only mode blocks all writes while you explore.

Output & logging

• Safe mode (on by default) masks secret-looking values (tokens, secrets, passwords) in results.
• Graph errors are shown structured (code / message / requestId), not as raw dumps, and never include the token or request bodies.

Network & updates

• HTTPS only, with certificate validation; timeouts and rate-limit-aware retries on every request.
• The frontend loads no remote content; external links open in your system browser.
• Releases are built only in CI and their SHA256SUMS.txt is signed with minisign — verify before running (see Installation).

Least privilege

Grant only the permissions you use (Permissions). Settings → Check access probes what your registration can actually do and can hide tabs you have no permission for.