Use this checklist when running a Rekurn API site, using the CLI, or embedding the SDK in an application.

• Store API tokens in environment variables or an OS secret store.
• Do not commit .env, .env.*, deploy hooks, private keys, signing keys, or production .rekurn/config files.
• Keep REKURN_TOKEN server-side when using the SDK in websites.
• Rotate tokens and deploy hooks if they are exposed.

• rekurn login stores session tokens in the OS keychain.
• Plain-text credential metadata may exist in ~/.rekurn/credentials.json, but bearer tokens should stay in the keychain.
• Use rekurn logout when removing a machine or shared account.
• Use rekurn settings to remove old site connections.

• Use HTTPS remotes in production.
• rekurn push rejects non-HTTPS remotes by default.
• REKURN_ALLOW_INSECURE_REMOTE=1 is for localhost development only.
• Do not put usernames, passwords, or tokens inside remote URLs.

Rekurn push protects repository state with:

• content-addressed objects
• server-side object hash validation
• compare-and-swap ref updates
• optional Ed25519 signed push certificates
• deletion metadata in commits so removed files do not stay live on remotes

To enable signed push certificates:

rekurn config signing-key ~/.rekurn/keys/push-ed25519

The key file must contain a 64-character Ed25519 secret key seed in hex.

.rekurnignore prevents new files from being tracked.

Default ignored paths include:

.git/
.rekurn/
target/
node_modules/
dist/
build/
.DS_Store
*.log
.env
.env.*

Ignore rules do not remove files that are already tracked. Use one of these commands for intentional removal:

rekurn rm path/to/file
rekurn rm --cached path/to/file

• Use HTTPS deploy hook URLs.
• Scope hooks to one environment when the provider supports it.
• Make hooks revocable.
• Validate hook payloads before starting a deployment.
• Avoid printing full hook URLs in public logs or screenshots.

• Use the SDK from server-side code for authenticated operations.
• Do not ship long-lived write tokens to browsers.
• Catch RekurnApiError and avoid leaking raw error details to users.
• Use expectedHash when updating refs to avoid overwriting concurrent changes.
• Keep allowInsecureHttp disabled outside localhost development.

Repository write access is required for:

• object upload
• ref updates
• deploy hook updates
• deployment records
• repository deletion

Public unauthenticated endpoints should remain rate-limited.

Run local verification before release work:

rekurn verify

For signed commits:

REKURN_VERIFY_PUBLIC_KEY=<hex-public-key> rekurn verify