Workspace security
Control access to Easel projects, production changes, and sensitive settings.
Workspace security determines who can view projects and perform sensitive actions.
Accounts
Protect Easel accounts with:
- Strong unique passwords, when password sign-in is enabled
- Secure OAuth account hygiene for connected identity providers
- Reviewed active sessions and revoked unused access
Sign-in options depend on your workspace configuration (for example GitHub OAuth).
Roles
Workspace roles follow least privilege. Easel uses these roles:
| Role | Typical access |
|---|---|
| Owner | Full workspace control, including billing and membership |
| Admin | Workspace and project administration |
| Member | Day-to-day project work such as deployments and configuration |
Owners and admins are managers for membership and workspace administration tasks. Prefer inviting members with the least access they need.
Sensitive actions
Treat these as high-impact changes:
- Viewing or editing secrets
- Changing domains
- Enabling Attack Mode
- Editing firewall rules
- Promoting deployments
- Rolling back production
- Deleting projects
- Managing members and billing
- Creating or revoking API tokens
API tokens
Use API tokens with the narrowest practical scope, rotate them regularly, and revoke tokens that are no longer needed. Avoid long-lived, unscoped personal tokens for production automation.
Sessions
Revoke sessions you no longer recognize and rotate credentials if you suspect account compromise. See Report a vulnerability for security contact details.