What Hoista protects against
What you trust
On your computer, you trust the operating system, your user account and its credential store, the Hoista build you installed and your providers. On a remote, you also trust the provider account, its secret variables, the volume and the image. An administrator of either can replace Hoista or read its memory.Limits
- The credential store has no Hoista lock. Hoista reads tokens without a biometric prompt each time, so malware running as you can reach them.
- Hoista doesn’t use the Secure Enclave, a TPM or remote attestation to protect tokens.
- On a remote, approvals are enforced by the gateway. The credential keeper doesn’t check them.
- Build isolation isn’t available on Windows.
- Some features don’t work on a remote yet. See Remote runtime.
- Someone who controls the daemon or its database can change Hoista’s activity history. Compare it with your providers’ own audit logs during an investigation.
- Pushing to a remote pauses agents on this computer, but this computer still holds working tokens. Revoke or rotate them if you retire it.
- Backups don’t include database contents, and rolling back a deployment doesn’t undo a migration.
Related
Incident checklist
What to do if something looks wrong.
Remote runtime
How a remote keeps your tokens.
Build isolation
How local builds are sandboxed.