Connect a service¶
Each page is the exact clicks for one system, and — more usefully — what to switch off. The second part is the one people skip, and it is the one that decides whether the credential is doing any work.
| Service | Policy | Credential | Tier | Setup |
|---|---|---|---|---|
| Grafana | grafana/read-only |
A Grafana service account token (starts glsa_) |
2 | ~3 min |
| Coolify | coolify/read-only |
Coolify API token | 1 | ~2 min |
| DigitalOcean | digitalocean/read-only |
A DigitalOcean personal access token, Read scope | 2 | ~2 min |
| GitHub | github/read-only |
A fine-grained personal access token | 2 | ~5 min |
| Cloudflare | cloudflare/read-only |
A Cloudflare API Token, Read permissions only | 2 | ~5 min |
| Prometheus | prometheus/read-only |
None, usually — or a reverse-proxy basic-auth login | 2 | ~10 min |
| PostgreSQL | postgres/read-only |
The role's password | 2 | ~3 min |
| SSH host | ssh/diagnostics-read |
Private key PEM (or a password) | 2 | ~5 min |
| Confluence | confluence/docs-read |
Atlassian API token | 2 | ~3 min |
| Grafana | grafana/oncall-read |
A Grafana service account token (starts glsa_) |
2 | ~3 min |
What Tier means¶
Tier 1 — the credential itself cannot write. A Coolify read-only token, a non-superuser Postgres role, a fine-grained GitHub token with nothing set to Read and write. Prodpeek is the second fence, and if it had a bug the credential would still refuse.
Tier 2 — Prodpeek is the only fence, because the vendor's credential is coarse or absent. Prometheus has no authentication at all; Grafana's service account roles are broad.
Neither is bad. An honest Tier 2 is worth more than a Tier 1 claim nobody checked,
and Prodpeek asks each vendor what your credential can really do on every
prove run — a "can write" answer demotes the service and
tells you.
The rule that runs through all of them¶
Grant the narrowest thing that works, then switch off anything that returns secrets.
Every page has a Do not grant these section. The entries there are not caution for its own sake — each one is a specific thing that would make the credential able to do something the policy assumes it cannot.
If your service is not here¶
The catalog is small on purpose: every profile is a judgement somebody made about every tool a vendor exposes, and a drafted profile nobody reviewed would be worse than none. Open an issue on prodpeek/profiles with the vendor and what you need to read.