Security and data handling

MarginCI runs your code on your machine or CI runner. Your application calls its configured providers and sends them the data its requests contain. Dependency installation contacts package registries. MarginCI does not require a hosted execution service or upload run files automatically.

Run trusted code only. Revision isolation protects measurement correctness; it is not a sandbox for hostile code. Your application has the credentials and filesystem privileges available to its process.

Credentials

Supply provider credentials through your approved environment. MarginCI does not load .env files. credential_env checks that a named variable is present; it is not an environment allowlist. Application code and dependency installers inherit the environment and must be trusted with it.

Do not put credentials in YAML, test inputs, source or agent messages. Use environment substitution for private registry credentials rather than committing them in .npmrc.

The CI template rejects fork PRs before checkout or credential use and exposes provider secrets only to the measurement step. Internal PR code and workflow changes must also be trusted. Repository owners control protected secrets, environment approvals and required checks. Never give unreviewed code provider keys.

Retained files and deletion

.marginci/runs/<run-id>/ retains configuration and test inputs, source snapshots and hashes, dependency-install records and logs, request measurements, per-attempt results, application stdout/stderr and reports. Files may contain proprietary source or sensitive input data.

The run root has permissions 0700; application stdout/stderr and runtime files use 0600. MarginCI does not delete runs automatically. After the process finishes, delete an individual run directory or the entire .marginci/runs/ directory when you no longer need the evidence. Manage any CI artifact copies separately.

Keep .marginci/ ignored and private. --json writes one report to stdout; application output stays in each attempt’s stdout.log and stderr.log. --verbose sends progress to stderr. Reports can include local paths for troubleshooting.

Captured request data and redaction

MarginCI records provider, endpoint, method, transport, request/resource IDs, timing, status, usage quantities, configured rates, cost basis and completion reasons. This metadata can be commercially sensitive.

It does not intentionally retain authorization headers, cookies, arbitrary request bodies or full response bodies. Only the request-ID header is retained for correlation. Captured URLs omit query strings, fragments and user information; unsupported endpoint paths are replaced.

Known nonempty configured/environment credential values are redacted from captured event metadata keys and string values, including nested data and captured errors. Credential-named fields are also redacted. Matching is literal after JSON decoding; unknown secrets and arbitrary encodings are outside this protection. If redaction produces duplicate keys, MarginCI adds redaction markers to keep each value. Redaction does not alter the provider data used to calculate cost.

This protection does not cover customer-authored configuration, test inputs, source snapshots, result files, application stdout/stderr or installer logs. Review those files before sharing; credentials printed by application code may remain intact.

Sharing reports

Start with the verdict, reason codes and runtime versions when requesting support. Review any report or log before sending it to support@marginci.com. Do not send provider keys or whole run directories by default. The private-alpha workflow has no automatic artifact upload; review content and retention before adding one.

Report a security issue privately to security@marginci.com.

CLI telemetry and website analytics

The CLI has no MarginCI telemetry endpoint, account or billing integration. Its provider and registry requests are separate from website analytics.

The website uses Cloudflare Web Analytics. This website analytics setup does not collect CLI run files or replace the provider requests made by your application.