SECURITY
Security and privacy
The service needs to see code to analyze and compile it, but it does not need production secrets, dumps, or user data.
Safe to send
- Application source code and templates.
- composer.json, composer.lock, and vendor when needed.
- Example configs, test values, and local settings without real keys.
- Minimal fixtures if they are needed for structural analysis.
Do not send
- Production .env, private keys, OAuth secrets, and API tokens.
- Database dumps, user uploads, and personal data.
- Internal server credentials, SSH keys, and auth.json.
- Archives with unknown contents inside the main archive.
What support needs
Usually the job log, command, stage, diagnostics, and a few lines around the error are enough. Support does not need full access to your production environment.