Credential Handling

To test an authenticated API, Dino needs to call it as an authenticated client. You configure auth profiles that hold the credential, and Dino uses it only to authenticate scan traffic to your own API. This page describes how those credentials are protected.

Storage

• Credentials are encrypted at rest with AES-256-GCM using a key derived uniquely for each tenant. The per-tenant key is derived from a master secret using HKDF (SHA-256), so one tenant's key cannot decrypt another tenant's credentials.
• Credentials are stored region-partitioned with the rest of your workspace data.

Write-only

• Once stored, a credential cannot be read back through the product. You see only a masked hint.
• You can replace or delete a credential at any time.

Use at scan time

• Plaintext credentials exist only briefly in memory during a scan, on the runner that runs that scan.
• For managed and pool runners, the credential is delivered to the runner only at scan time, through an access-controlled step gated by the per-scan capability token, so a runner only ever receives the credential for its own assigned scan.
• For self-hosted runners, decryption and use of the credential happen inside your own infrastructure.

No secret leakage

Dino is designed so that credential values, tokens, cookies, one-time codes, and sensitive headers such as Authorization, Cookie, Set-Cookie, and API-key headers are not written to operational or customer-facing surfaces. Redaction is applied at the shared layer rather than at the user interface, covering logs, errors, and the analytics path.

Login flows and multi-factor

For APIs that require a login rather than a static key, Dino can run a multi-step login flow: submit credentials, carry cookies and CSRF tokens across steps, generate time-based one-time codes, and refresh expired tokens. The same storage, write-only, redaction, and scan-time-only handling apply to every secret used in the flow.

Bring your own key

Model-provider keys supplied for bring-your-own-key AI are handled under the same storage and redaction model and are used only to authenticate your own AI requests.

Deletion

When you delete a credential, auth profile, API, or workspace, the associated encrypted credential is removed as described in our Data Retention and Deletion Policy.

Honest behavior

A scan that cannot authenticate reports that it could not authenticate. Dino never fabricates a successful authentication or silently proceeds as if authenticated.

Contact

security@usedino.dev