Sandbox Mode vs. Limited‑Access PAT: Which Keeps Production Credentials Safe?

Question

Sandbox Mode
Codeac’s documented “sandbox mode” is intended to simulate repository interactions locally, preventing real API calls. In theory, it allows a scan to run without contacting GitHub, GitLab, or Bitbucket, thus eliminating any risk of accidental writes or rate‑limit violations.
Limited‑Access Personal Access Token
Alternatively, a dedicated test repository can be paired with a PAT that has read‑only scopes (e.g., repo:read for GitHub). Codeac uses this token to authenticate against the host, performing the same scans as in production but with minimal privileges.
Unresolved Decision

Does Codeac strictly enforce the scopes of a read‑only PAT, or can it still trigger write actions such as posting comments or updating statuses in edge cases?
Is sandbox mode truly isolated across all supported Codeac releases, or does it vary by environment?
Which approach provides a more reliable guarantee that production credentials remain untouched during continuous‑integration testing?

These questions remain unanswered in the current documentation, making it difficult to choose the safest testing strategy.

Tasadduq Burney · Answer

Direct answer
Sandbox mode provides the stronger guarantee that production credentials stay untouched because it blocks all outbound API requests, so no credential is ever sent to the host.
Confirmed facts

Sandbox mode, as documented, prevents any network traffic to the repository host, eliminating credential transmission.
A limited‑access personal access token (PAT) still authenticates; even with read‑only scopes it can be used by the SDK to call any endpoint the token permits.

Likely explanation
If the Codeac SDK interprets certain read‑only‑scoped calls as write operations (for example, posting a check run or updating a commit status), a read‑only PAT could still trigger writes, weakening its safety.
Steps to verify for your environment

Run a sandbox scan and capture network traffic (e.g., tcpdump -i any port 443 and host api.github.com) to confirm no outbound requests appear.
Run a scan with a limited‑access PAT and capture traffic; look for any POST, PATCH, or PUT requests to the host.
Inspect the Codeac SDK (or source, if available) to see which API methods are invoked when a read‑only token is used.

Missing diagnostic detail
Does the Codeac SDK ever map a read‑only‑scoped token to a write‑type endpoint under any condition? Knowing this would change the recommendation: if yes, sandbox mode is preferred; if no, a limited‑access PAT is acceptable.

Sandbox Mode vs. Limited‑Access PAT: Which Keeps Production Credentials Safe?

Sandbox Mode

Limited‑Access Personal Access Token

Unresolved Decision

1 answer

Direct answer

Confirmed facts

Likely explanation

Steps to verify for your environment

Missing diagnostic detail

Your perspective belongs here.

0 question comments