Security

Scalpels is a control plane. It stores the tenant, deployment, connection, billing, and status records needed to coordinate work, while the deployed applications, their infrastructure, and their product data remain in the customer's own accounts.

Credentials stored by Scalpels

The following secrets are stored encrypted at rest and hidden from normal model serialization:

• the team's Laravel Cloud and Laravel Forge API tokens;
• short-lived GitHub App installation tokens while cached;
• provider ownership tokens and webhook secrets;
• per-deployment Console signing keys and least-privilege vitals tokens.

Cloud and Forge tokens are scoped to one team. Provider and Console credentials are scoped to one deployment. Stored credentials are not rendered back to the browser after creation; the Cloud and Forge settings screens show only a short hint.

Credentials Scalpels does not retain

The GitHub user token used to verify an installation callback is used for that check and discarded.

A credential minted while attaching an application is written directly to the selected Cloud environment or merged into the selected Forge site's .env. Scalpels records its non-secret name for attribution and repair, not the plaintext value. The provider stores only the credential hash, so the value cannot be read back later.

Values supplied for a product manifest are encrypted while the deployment is queued. After they are delivered to Laravel Cloud, Scalpels clears them and keeps only the variable names in the deployment-step record.

Forge .env contents are read only during an explicit attachment because Forge replaces the whole file on write. Scalpels does not persist that file and does not decode its existing values.

What is excluded from logs and errors

Laravel Cloud and Forge error wrappers discard remote response messages and response bodies. Reportable failures are rebuilt from application-owned operation names, numeric status codes, and bounded allowlisted metadata rather than third-party prose that may echo a secret.

Forge environment-file refusals name a key or line number, never the line's contents. Credential-bearing model attributes are hidden so serializing a model as log context does not include them.

Pattern-based redaction remains a fallback for unexpected third-party text, not the primary boundary. Known Cloud and Forge failures are made safe by discarding remote text before it can reach a screen, database failure reason, or application log.