Security whitepaper
Deployment boundaries, access controls and independent testing for your security review.
This document outlines Semaphore’s security controls and the responsibilities of operating a self-hosted deployment. Use it alongside the documentation for your installed version, edition and configuration.
Independent penetration testing
CyberSecurityArm performed a gray-box security assessment of a Semaphore UI development deployment on 4–7 May 2026.
- Scope
- Web application, REST API, authentication, authorization and session handling
- Identity flows
- SSO/OIDC where configured and accessible in the assessed environment
- Environment
- Development deployment, tested with administrative and standard-user access
The assessment describes that deployment at the time of testing. Its scope and follow-up evidence should be reviewed alongside your own deployment requirements.
Request penetration test resultsISO/IEC 27001
We are working towards ISO/IEC 27001 certification. Ask us about the current status as part of your security review.
Deploy within your security boundary
You choose where the Semaphore server, database and runners operate. Your team manages:
- Network access, TLS and host security
- Database and encryption-key backups
- Retention and recovery procedures
Runners execute automation with access to the repositories, credentials and targets needed for their jobs. Use appropriate network boundaries and operating-system permissions. Placing a job on a runner does not automatically isolate it from that runner’s environment.
Review outbound connections for Git, identity providers, secret stores, notifications and licensing. Enterprise offers offline licensing for isolated environments.
Control access to automation
Project membership and built-in roles govern access to shared operations. Enterprise custom roles and granular permissions let you delegate selected actions on templates and workflows. Start with a limited project role, then grant the additional access each person needs.
Pro and Enterprise support TOTP, LDAP and OpenID Connect authentication. Review the permission model and identity configuration for the version you deploy.
Protect credentials
Configure encryption keys for stored credential values, protect those keys separately from database backups, and plan rotation and recovery. Supported external secret stores can connect Semaphore to your existing credential systems.
Automation still needs credentials at execution time. Review who can edit automation code, which target permissions its credentials grant, and what scripts write into task output.
Review execution evidence
Task history, activity history and server logs support operational review. Decide who can access them, how long they are retained, and whether your edition and version provide the export or logging integration you need. Avoid writing credentials into task output.
Plan upgrades and recovery
Use a current stable release appropriate for your environment. Review upgrade notes, back up the database and encryption keys, and test restoration. For active-active HA, include shared database and Redis services in your availability plan.
Request security evidence
Request the penetration test results and assessment scope for your evaluation. Include your target version, proposed deployment and any evidence your security review requires.
For a vulnerability report, send the affected version, impact and reproduction details privately to [email protected] . Do not include production credentials.