Security

Flitz is for your own team's work-in-progress builds, reviewed during development. This section gathers what that means for your code and data, and the Enterprise features that let you tighten it.

What a bundle can do

A bundle runs with the full privileges of the host: the same permissions, the same data, and the same network access as your app. In a host with sign-in, that includes the signed-in teammate's Flitz session. The loader checks that a bundle fits the host, not where it came from, so run only bundles your own team publishes — untrusted third-party bundles are not supported. See The compatibility contract.

Who can open a build

• By default, anyone who holds a link. Landing-page, deeplink, bundle, and track links work for whoever has them, and they do not expire. Per-publish links end in a random suffix; a track link can be worked out from one of your other links. See Links.
• Members only, an Enterprise feature, limits an app's builds to your host with sign-in, for a signed-in member of your organization. See Download access.
• To take a build down, delete the publish or its app. See Archive, delete, and restore.

Where your bundles are stored

By default, Flitz stores your bundles in its own storage. With customer bundle storage, an Enterprise feature, they are kept in a bucket your organization owns, and no bundle passes through Flitz. Either way, the publish records and the landing pages stay with Flitz.

Accounts and credentials

• Your Flitz account signs you in to the CLI (flitz login) and the portal. On Flitz Enterprise, an organization can sign its members in through its own identity provider — see Single sign-on.
• The organization API key lets CI publish without a person's session. It is shown once, rotating or revoking it cuts off pipelines at once, and it cannot delete publishes or change apps. See flitz apikey.
• The package repository token gives your build machines the loader plugins. flitz plugins credentials --write stores it in files only your user can read; never commit it. See Credentials.
• A teammate's sign-in session, in a host with sign-in, lives in your app's private storage on the device, and bundles can read it. See What sign-in does not do.