MAGDOX Code Security documentation
Authentication and access
How a person or a pipeline gains access, what a token can do, and how access is revoked.
Status: Preview
Authentication is the gate to everything: without it the CLI can neither fetch rules, upload findings nor download reports. A person signs in through the browser; a pipeline uses a token issued for it. Both are tied to an organisation and to a role.
Interactive sign-in
magdox login
# Opens the browser, completes sign-in, stores a short-lived credential in the OS keychain where available.
magdox whoami
magdox logoutTokens for CI
# Created in the review UI under Organisation > Tokens. Scoped, named, expiring, revocable.
export MAGDOX_TOKEN="<token>"
magdox whoamiRoles
| Role | Can | Cannot |
|---|---|---|
| Owner | Everything below, plus manage members, tokens, retention and billing contacts | Be removed as the last owner |
| Admin | Manage projects, tokens and members; all analyst actions | Change organisation-level retention or delete the organisation |
| Analyst | Upload scans, triage findings, record decisions, download reports and exports | Manage members or tokens |
| Viewer | Read runs, findings, reports; download reports | Upload scans or change decisions |
Token scopes
- scan: upload findings for named projects.
- read: list runs, read findings, download reports and exports.
- decide: record or change reviewer decisions (normally people, not pipelines).
- admin: manage projects and tokens (rarely granted to a token).
Revocation and audit
Tokens are revoked from the review UI and stop working immediately. Sign-ins, token creation, token use and downloads are written to the organisation audit log with actor, time, source and outcome.
Single sign-on (OIDC) and enforced MFA are confirmed per engagement.