Credential protection

Asset credentials are the most sensitive material WingGate handles. This article describes how they are stored, where they can never appear, and how the target's identity is verified on connect: SSH by host key, SMB / WebDAV / S3 file backends by each protocol's own anchor.

Secrets stay out of lists, logs, and errors

Asset-credential secrets are write-only through the normal API: list and detail responses never return secret material — that holds for an SSH connection profile and for a credential record a file backend references alike. Secrets are excluded from logs, audit entries, and error responses. A failed operation returns an error code and message, never the credential that failed.

Encryption at rest

Asset credentials are stored encrypted with AEAD (AES-256-GCM) and are never returned through the API; connectors receive them only through a scoped credential-by-reference exchange. Asset metadata, grants, and audit history live in the service's backing store, inside the service's trust boundary.

SSH host key probing, confirmation, and override

Before the first SSH connection to an asset, WingGate probes the host key and asks you to confirm it. A later mismatch blocks the connection and surfaces a warning — this is the signal for a possible man-in-the-middle or a reinstalled host. You can manually override after reviewing the new fingerprint; the override is a deliberate, audited action, not a silent retry.

File backends have no host key, and their anchor differs per protocol: WebDAV requires HTTPS and a confirmed server SPKI fingerprint before its tool group is enabled (a certificate rotation needs a new confirmation); SMB has no certificate to pin, so identity comes from SMB3's mandatory signing plus mandatory encryption, with NTLMv2 only and no downgrade option — confirm at connect time that the server is the one you meant; the S3 endpoint is validated only by the public roots the HTTP client trusts, with per-request SigV4 for the request direction and no operator-confirmed identity fact. See Working with Files.