Ordyn

Appearance

Secrets ​

Ordyn stores reusable secrets and exposes them only through places that explicitly accept secrets.

Secrets are managed under Library > Secrets.

Behavior ​

  • Creating a secret requires a value.
  • Editing a secret can leave the value blank to keep the current value.
  • Editing a secret can provide a replacement value.
  • Ordyn never shows the current stored secret value back after saving.
  • Job definitions, workflows, and script definitions store secret references, not plaintext values.

Use secrets through one of these supported paths:

  • secret variables
  • saved script parameters with type secret
  • Windows account username and password secret selectors
  • integration settings that explicitly ask for a secret

Do not reference secrets directly from templates by slug. Secret values are not available through secrets.*. If a template or expression needs a secret-backed value, create a secret variable and reference the variable, for example {{ vars.registry.token }}.

Scripts And Secret Parameters ​

Saved scripts can define parameters with type secret.

At runtime:

  • the job or workflow step stores the selected Ordyn secret reference for that parameter
  • Ordyn resolves the real secret value during execution
  • the endpoint agent receives the value as a redaction token

The plaintext value is still exposed to the running process because the script needs it to do useful work. Avoid printing secrets, avoid passing them to child processes that log their command lines, and prefer APIs or tools that can read credentials from files or standard input when available.

Secret Variables ​

Secret variables let templates and expressions use secret-backed values without referencing a secret directly.

Create a variable definition with Secret enabled and select a secret for the default or override value. Runtime templates can then use the variable key:

text
{{ vars.registry.token }}

Expression fields use the same variable path without braces:

text
vars.registry.token

Redaction ​

For endpoint-side instructions, Ordyn sends known secret values to the agent as redaction tokens. This covers values resolved from secret variables and saved script secret parameters. Exact matches are redacted from endpoint stdout, stderr, operational command-output logs, and audit command invocation logs.

This does not make every possible derived value secret-safe. Partial secrets, transformed values, hashes, encoded values, and values copied into external tool logs are outside exact redaction. Server-side scripts run in the Ordyn server context and should be treated as trusted code.