Security

Transport

All API traffic uses HTTPS with a valid TLS certificate. Never disable certificate verification — no curl -k, no NODE_TLS_REJECT_UNAUTHORIZED=0. Guardian Logs never needs inbound access to your servers; you push to us.

Credential handling

• Keep credentials in environment variables or a protected secrets store —

never in source control, tickets, or shell history. Use the $GUARDIAN_API_KEY / $GUARDIAN_INGEST_TOKEN env-var pattern shown throughout these docs.

• Credentials are shown in plaintext once at creation. Only a SHA-256 of the

secret half is stored, so a lost credential cannot be recovered — rotate it.

• Use one credential per host/source so you can rotate narrowly without

disrupting everything else.

• Rotate by minting a replacement and deploying it before retiring the old

one. Revoke takes effect immediately (next request → 401).

• Never echo a credential back to us inside a log message or metadata.

Tenant isolation

• The organization is always derived from the credential row, never from any

request field. You cannot reach another tenant's data by manipulating an id, cursor, or filter.

• A cross-tenant id returns 404 — indistinguishable from a nonexistent one.
• Authentication failures return a uniform 401 regardless of the reason,

so callers cannot probe for the existence of credentials, orgs, or apps.

• Ingest tokens are write-only and bound to a single source; API keys are

read-only and gated by explicit scopes. Neither can perform the other's actions.

What NOT to send (ingest)

Guardian Logs stores log content. Redact secrets and PII at the source before sending. Do not transmit passwords, session tokens/cookies, Authorization headers or bearer tokens (including your own gl_live_ token), API secrets, DB connection strings with inline credentials, payment data, or unnecessary PII.

As defense in depth, Guardian Logs applies best-effort server-side redaction of obvious secret shapes at ingestion — but this is pattern matching, not a guarantee. You remain responsible for what you transmit. Full guidance is in ingest.md.

See also: authentication.md · scopes.md · idempotency.md.