Swarmby Myrik

Credentials & repos

Settings are per-organization. Anyone in the org shares the same API keys, GitHub token, repos, and label configs.

Credentials are stored in DynamoDB (encrypted at rest with AWS-managed keys). Exports from /orgs are cleartext JSON — treat the file as a secret.
Keep in mind — credentials are injected per run from the org settings at start time — rotate a key and the next run picks it up; in-flight runs keep the key they launched with.

Organizations & members

  1. 1
    Each user gets a personal org on sign-in. Create more at /orgs.
  2. 2
    Owners can add members by email. If the invitee doesn't have an account yet, one is created on the spot and a one-time temp password is shown — share it out-of-band. Sign-up is otherwise gated by ALLOWED_SIGNUP_EMAILS or a matching auto-join domain.
  3. 3
    Switch orgs on the /orgs page. It reloads so settings/runs re-scope.
  4. 4
    Owner-only: invite/remove members, export/import settings. Members can create runs and view/edit shared settings.
Keep in mind — per-repo learnings (review pitfalls, planner notes, proven procedures) are scoped to (org, repo) — two orgs on the same public-fork URL never share cached findings. Org isolation is a hard invariant.

Two-factor authentication (TOTP)

  1. 1
    Visit /settings/security and click Enable two-factor auth.
  2. 2
    Scan the QR code with an authenticator app, or enter the base-32 secret manually.
  3. 3
    Enter the first 6-digit code to confirm. You'll get 10 one-time recovery codes — save them; they won't be shown again.
  4. 4
    On every sign-in after this you'll be prompted for a code. Lost your device? Enter a recovery code in the same field — each works once.
  5. 5
    To rotate or disable MFA, visit the Security page; both require your current authenticator code.
Keep in mind — recovery codes are the only way back in if you lose your authenticator — store them in a password manager, not next to the device.

Audit log

Every sensitive action inside an org is recorded: sign-ins, settings changes, run starts/cancels, member add/remove, MFA events, and settings export/import.

Only the org owner can view the log. The last 20 events appear on /orgs under "Recent activity"; full history is paginated via GET /api/orgs/:orgId/audit. Entries are stored in DynamoDB with point-in-time recovery enabled.