Ottili Coder

Coder security

How Ottili Coder handles identity, secrets, approvals, tenant isolation, and the audit trail.

Coder is built on the Ottili platform's identity, permission, and audit model. Security is not a separate add-on.

Identity and access

Coder authenticates through your Ottili identity ("Sign in with Ottili").
Access follows your company and role model.
Approval gates hold risky or external steps until a person approves them.

Secrets

Secrets are resolved through Ottili at execution time.
They are not stored in plain text on the runner.
Do not put secrets in mission text; reference them through Ottili instead.

Tenant isolation

Coder runs in your Ottili company context. A run can only touch what your role and company permit, the same as the rest of the platform.

Audit trail

Every run keeps a record of who did what and when: the mission, the queue, the agents, the approvals, the logs, and the final status. The audit trail is identical across local, cloud, and hybrid runs.

Cloud runs

Cloud runs send repository and task context to a managed workspace. Cloud runs are in beta and are not intended for production secrets without review. Local runs keep source on your machine.

Responsible use

Review pull requests Coder opens before merging.
Keep plugins from trusted sources and review them before enabling.
Report security issues through the platform's responsible disclosure channel.