> For the complete documentation index, see [llms.txt](https://docs.resifactory.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.resifactory.net/credentials/security.md).

# Keeping credentials safe

You hold three different kinds of secret. They have different blast radii, and knowing which is which tells you how carefully to treat each.

| Credential            | What it opens                                                      | If it leaks                                               |
| --------------------- | ------------------------------------------------------------------ | --------------------------------------------------------- |
| **Sign-in password**  | The web console — everything you own, including credential export. | Worst case. Change it immediately.                        |
| **App password**      | IMAP reads, within its scope and window.                           | Revoke it. One click, live sessions drop instantly.       |
| **Mailbox passwords** | The individual mailboxes, directly at the provider.                | The hardest to contain. They are not revocable from here. |

## The habits

### Never put your sign-in password in a tool

Tools get an [app password](/imap/app-passwords.md). Always. Your sign-in password should exist in your head and your password manager, nowhere else.

### One app password per tool

It costs nothing and buys you a lot:

* Revoking one tool never breaks another.
* **Last used** tells you which tools are actually running — and which credential is stale enough to revoke.
* Each tool gets the [window](/imap/inbox-window.md) that suits it.

### Scope down when you can

If a tool only needs one project's mail, give it a [batch-scoped](/imap/scopes.md) credential. The boundary is enforced on the server — that credential cannot reach the rest of your mail by any command.

### Use the IP allowlist only if your IP is genuinely fixed

On a static address — a server, a fixed office line — an allowlist is a strong control.

On anything that moves, it locks you out and the symptom looks exactly like a wrong password. Do not set it "just in case".

### Revoke on the way out, not later

Revoke immediately when:

* You stop using a tool.
* A machine that held a credential is lost, sold, or handed on.
* You shared a credential with someone whose access has ended.
* A credential was pasted anywhere you would not want it — a chat, a ticket, a screenshot.

Revocation is instant: live IMAP sessions using it are disconnected at once.

### Treat exported files as live credentials

An export is a file of working passwords. Handle it accordingly:

* Delete it as soon as the import is done. It is not a backup.
* Never leave it in Downloads, or in a synced folder, or in cloud storage that is shared more widely than you think.
* Never paste it into a chat, a ticket, a pastebin, or an AI tool.
* Do not commit it. Add `*.csv` and `accounts.json` to `.gitignore` if there is any chance.

### Keep secrets out of source code

Read them from environment variables or a secrets manager:

```python
import os
password = os.environ["OMS_APP_PASS"]   # good
password = "wxrm-4k7t-p2qd-h9fs"        # never
```

A credential in a repository is a credential in every clone of that repository, forever, including the history after you delete the line.

### Set a recovery email

Not a leak concern, but a lockout one. Without a confirmed recovery address there is no self-service way back into your account. See [Signing in](/getting-started/signing-in.md).

## What the server does for you

* **TLS is mandatory.** Port 993 only, implicit TLS, no plaintext path.
* **Passwords are hashed.** App passwords are stored hashed and shown exactly once. Nobody can read yours back — which is also why a lost one must be replaced rather than recovered.
* **Failed logins are rate-limited.** Repeated failures temporarily block further attempts from that username and IP.
* **Revocation is immediate.** Not at the end of a session, not after a timeout.
* **Reveals and exports are recorded.** What was taken, and when.

## If something leaks

**An app password:**

1. Revoke it. **App passwords** → right-click → **Revoke**. Live sessions drop instantly.
2. Create a replacement and update the tool.

**Your sign-in password:**

1. Change it in **Settings → Password**. That signs out every session everywhere.
2. Review **App passwords** for anything you do not recognise, and revoke it.

**A credential export:**

1. The mailbox passwords in it cannot be revoked from this console — tell whoever sold you access, promptly.
2. Delete every copy of the file.
3. Review the mailboxes on [Accounts](/the-console/accounts.md) for anything odd.

## A safe setup, as an example

| Label               | Scope                | Window     | IP allowlist       |
| ------------------- | -------------------- | ---------- | ------------------ |
| `shikari-main`      | unified              | 15 minutes | –                  |
| `order-tracking`    | unified              | 14 days    | –                  |
| `contractor-august` | batch → aug-drop-100 | 7 days     | their office range |
| `archive-script`    | unified              | 3 months   | server IP only     |

Four credentials, four jobs. Any one can be revoked without touching the rest, and the contractor's cannot see anything outside their campaign.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.resifactory.net/credentials/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.