Feature
Pre-flight against a reviewed allowlist
Before any credential is used, every service is checked against a committed allowlist and dropped if anything is unexpected.
Pre-flight checks each service in the inventory: its source, its fields, each target’s platform, and each target’s identity fields against the allow record. An unknown field, a platform without a rule or a changed identity drops the service.
Drops do not stop the run; the rest of the fleet is still collected and the dropped names are reported.
dotenv targets are never allowed: they read an arbitrary file path from the manifest.
More features
All features →- 01
One page for the whole fleet
Every target’s latest state per key, plus the last 20 collector runs, on one read-only page.
- 02
Silence reads as stale
A target with no ok drift snapshot within STALE_AFTER_HOURS is flagged. A dead collector turns every target stale.
- 03
Never a secret value
The database stores 12-character fingerprints, not values. The viewer compares them on the server and sends only the verdict.