MAGDOX Code Security documentation

Authentication and access

How a person or a pipeline gains access, what a token can do, and how access is revoked.

Status: Preview

Authentication is the gate to everything: without it the CLI can neither fetch rules, upload findings nor download reports. A person signs in through the browser; a pipeline uses a token issued for it. Both are tied to an organisation and to a role.

Interactive sign-in

bashplaceholder
magdox login
# Opens the browser, completes sign-in, stores a short-lived credential in the OS keychain where available.
magdox whoami
magdox logout

Tokens for CI

bashplaceholder
# Created in the review UI under Organisation > Tokens. Scoped, named, expiring, revocable.
export MAGDOX_TOKEN="<token>"
magdox whoami

Roles

Roles
RoleCanCannot
OwnerEverything below, plus manage members, tokens, retention and billing contactsBe removed as the last owner
AdminManage projects, tokens and members; all analyst actionsChange organisation-level retention or delete the organisation
AnalystUpload scans, triage findings, record decisions, download reports and exportsManage members or tokens
ViewerRead runs, findings, reports; download reportsUpload scans or change decisions

Token scopes

  • scan: upload findings for named projects.
  • read: list runs, read findings, download reports and exports.
  • decide: record or change reviewer decisions (normally people, not pipelines).
  • admin: manage projects and tokens (rarely granted to a token).

Revocation and audit

Tokens are revoked from the review UI and stop working immediately. Sign-ins, token creation, token use and downloads are written to the organisation audit log with actor, time, source and outcome.

Single sign-on (OIDC) and enforced MFA are confirmed per engagement.