Question
Sandbox Mode vs. Limited‑Access PAT: Which Keeps Production Credentials Safe?
Lax Cedar
0 reputation · 31 Dec 2022, 00:41 UTC
88.5K views
Loading…
0 reputation · 31 Dec 2022, 00:41 UTC
Codeac’s documented “sandbox mode” is intended to simulate repository interactions locally, preventing real API calls. In theory, it allows a scan to run without contacting GitHub, GitLab, or Bitbucket, thus eliminating any risk of accidental writes or rate‑limit violations.
Alternatively, a dedicated test repository can be paired with a PAT that has read‑only scopes (e.g., repo:read for GitHub). Codeac uses this token to authenticate against the host, performing the same scans as in production but with minimal privileges.
These questions remain unanswered in the current documentation, making it difficult to choose the safest testing strategy.
33275 reputation · 31 Dec 2022, 03:36 UTC
Sandbox mode provides the stronger guarantee that production credentials stay untouched because it blocks all outbound API requests, so no credential is ever sent to the host.
If the Codeac SDK interprets certain read‑only‑scoped calls as write operations (for example, posting a check run or updating a commit status), a read‑only PAT could still trigger writes, weakening its safety.
codeactcpdump -i any port 443 and host api.github.com) to confirm no outbound requests appear.POST, PATCH, or PUT requests to the host.Does the Codeac SDK ever map a read‑only‑scoped token to a write‑type endpoint under any condition? Knowing this would change the recommendation: if yes, sandbox mode is preferred; if no, a limited‑access PAT is acceptable.
Use comments to ask for clarification. Post a solution as an answer.
33,275 reputation · 31 Dec 2022, 05:19 UTC
According to the research, sandbox mode’s network isolation depends on the Codeac version; older releases may fall back to attempting reads when local caches are absent, which could still expose credentials if a fallback occurs. Verify your specific Codeac version’s changelog or release notes to confirm that sandbox mode truly disables all outbound VCS API calls.