# \#security **URL:** https://discuss.bitrise.io/tag/security/49.md [Latest](https://discuss.bitrise.io/latest.md) · [Categories](https://discuss.bitrise.io/categories.md) · [Tags](https://discuss.bitrise.io/tags.md) --- ## [Prevent users with "developer" role from manual builds](https://discuss.bitrise.io/t/prevent-users-with-developer-role-from-manual-builds/24293)
**Author:** [@arthur\_clark\_1](https://discuss.bitrise.io/u/arthur_clark_1)\ **Replies:** 0\ **Last updated:** [July 8, 2024, 9:48pm UTC](https://discuss.bitrise.io/t/prevent-users-with-developer-role-from-manual-builds/24293 "2024-07-08T21:48:05Z")
Hello Bitrise Community! I’m wondering if there is a way for an Admin to limit the ability of certain roles to start a build manually, ideally on a per workflow basis. We have workflows that trigger releases in several e… --- ## [Account Security Questions](https://discuss.bitrise.io/t/account-security-questions/18439)
**Author:** [@ajanuar](https://discuss.bitrise.io/u/ajanuar)\ **Replies:** 1\ **Last updated:** [December 14, 2021, 10:24pm UTC](https://discuss.bitrise.io/t/account-security-questions/18439 "2021-12-14T22:24:16Z")
Hello Bitrise team, I have some questions related account. Does Bitrise have any repeated password history cycle? Does Bitrise have password expiration? Is yes, how long? Does Bitrise have limitation of maximum login … --- ## [Does Bitrise support external key vaults?](https://discuss.bitrise.io/t/does-bitrise-support-external-key-vaults/17671)
**Author:** [@michal.kwiecinski](https://discuss.bitrise.io/u/michal.kwiecinski)\ **Replies:** 1\ **Last updated:** [August 13, 2021, 1:04pm UTC](https://discuss.bitrise.io/t/does-bitrise-support-external-key-vaults/17671 "2021-08-13T13:04:38Z")
To centralize secret management, I wanted to use Azure Key Vault, Hashicorp Vault or AWS KMS to store secrets that would be further utilized to build an app (both iOS and Android). Is it natively supported with Bitrise … --- ## [SAML SSO login error for accounts already connected via GitLab](https://discuss.bitrise.io/t/saml-sso-login-error-for-accounts-already-connected-via-gitlab/10608)
**Author:** [@usmonster](https://discuss.bitrise.io/u/usmonster)\ **Replies:** 1\ **Last updated:** [October 18, 2019, 2:45pm UTC](https://discuss.bitrise.io/t/saml-sso-login-error-for-accounts-already-connected-via-gitlab/10608 "2019-10-18T14:45:00Z")
Hello, We’ve enabled (not enforced) SAML SSO on our organization, and it seems to work fine for new users, though we are seeing this error for existing members that initially connected to Bitrise via GitLab: Note: T… --- ## [Organization-wide secrets](https://discuss.bitrise.io/t/organization-wide-secrets/9446)
**Author:** [@dominik.roszkowski](https://discuss.bitrise.io/u/dominik.roszkowski)\ **Replies:** 2\ **Last updated:** [July 19, 2019, 5:38pm UTC](https://discuss.bitrise.io/t/organization-wide-secrets/9446 "2019-07-19T17:38:09Z")
Description of the feature request I would love to be able to set some organization-wide secrets to be used within build steps. They could be available as protected without read access. Use case / for what or how I woul… --- ## [Solution for convoluted Service Key JSON issue in Deploy to Google Play step](https://discuss.bitrise.io/t/solution-for-convoluted-service-key-json-issue-in-deploy-to-google-play-step/6252)
**Author:** [@tallpants](https://discuss.bitrise.io/u/tallpants)\ **Replies:** 5\ **Last updated:** [October 10, 2018, 11:44am UTC](https://discuss.bitrise.io/t/solution-for-convoluted-service-key-json-issue-in-deploy-to-google-play-step/6252 "2018-10-10T11:44:51Z")
Hey guys, So this is in reference to the issue described here: How to handle Google Play service JSON key in the latest Deploy to Google Play step? Like @bitce suggested, I’m opening a feature request about this. I can… --- ## [Force/suggest enabling two-factor authentication](https://discuss.bitrise.io/t/force-suggest-enabling-two-factor-authentication/4863)
**Author:** [@boyvanamstel](https://discuss.bitrise.io/u/boyvanamstel)\ **Replies:** 1\ **Last updated:** [April 30, 2018, 7:00pm UTC](https://discuss.bitrise.io/t/force-suggest-enabling-two-factor-authentication/4863 "2018-04-30T19:00:31Z")
Description of the feature request For organizations and bigger teams it can be hard to make sure connected accounts are kept secure. Forcing or suggesting two-factor authentication when a team member is added would make… --- ## [Can I safely access secrets from env variables?](https://discuss.bitrise.io/t/can-i-safely-access-secrets-from-env-variables/4759)
**Author:** [@gkarlsson-ioki](https://discuss.bitrise.io/u/gkarlsson-ioki)\ **Replies:** 1\ **Last updated:** [April 11, 2018, 4:07pm UTC](https://discuss.bitrise.io/t/can-i-safely-access-secrets-from-env-variables/4759 "2018-04-11T16:07:19Z")
Hi. Let’s say I have defined a secret as API\_KEY=abc123, can I reference it in an env variable like SOME\_KEY=$API\_KEY or will the secret “leak” when I do this? --- ## [Do you expire all sessions upon password change?](https://discuss.bitrise.io/t/do-you-expire-all-sessions-upon-password-change/3089)
**Author:** [@dvdchr-tvlk](https://discuss.bitrise.io/u/dvdchr-tvlk)\ **Replies:** 5\ **Last updated:** [October 25, 2017, 9:54am UTC](https://discuss.bitrise.io/t/do-you-expire-all-sessions-upon-password-change/3089 "2017-10-25T09:54:46Z")
To give you context, one of my colleague has her account used by somebody we didn’t know. Maybe she gave her account details to someone due to some urgency – but now she has reset her password. My question is, does your … --- ## [Password Requirement for viewing Keystore/Certificate Passwords](https://discuss.bitrise.io/t/password-requirement-for-viewing-keystore-certificate-passwords/3082)
**Author:** [@lengk](https://discuss.bitrise.io/u/lengk)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 12:47pm UTC](https://discuss.bitrise.io/t/password-requirement-for-viewing-keystore-certificate-passwords/3082 "2017-10-23T12:47:03Z")
Description of the feature request For sensitive information such as the signing key to android keystore, it may be good to require the user password to view the passwords for that session, giving the option to turn this… --- ## [Password protect certain apps](https://discuss.bitrise.io/t/password-protect-certain-apps/2885)
**Author:** [@streaka](https://discuss.bitrise.io/u/streaka)\ **Replies:** 5\ **Last updated:** [October 13, 2017, 10:39am UTC](https://discuss.bitrise.io/t/password-protect-certain-apps/2885 "2017-10-13T10:39:09Z")
Some apps could deploy something to production, being logged into bitrise may be too poor security wise… it would be great for just one more layer of protection to confirm the running/editing of a step. --- ## [2FA (Two Factor Auth / Two Step Auth) improvements](https://discuss.bitrise.io/t/2fa-two-factor-auth-two-step-auth-improvements/1166)
**Author:** [@norbert](https://discuss.bitrise.io/u/norbert)\ **Replies:** 0\ **Last updated:** [March 20, 2017, 5:00pm UTC](https://discuss.bitrise.io/t/2fa-two-factor-auth-two-step-auth-improvements/1166 "2017-03-20T17:00:32Z")
About two weeks ago we released the Two-factor authentication feature, which helps to make your bitrise.io account more secure. Today we released a set of updates to make it even easier and more straight forward to setu… --- ## [Increased login/session timeout](https://discuss.bitrise.io/t/increased-login-session-timeout/992)
**Author:** [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Replies:** 0\ **Last updated:** [March 1, 2017, 3:14pm UTC](https://discuss.bitrise.io/t/increased-login-session-timeout/992 "2017-03-01T15:14:46Z")
In addition to the remember me functionality (and the related feature request) login session timeout was increased from 12 hours to 48 hours. --- ## [2FA (Two Factor Auth / Two Step Auth) is finally available!](https://discuss.bitrise.io/t/2fa-two-factor-auth-two-step-auth-is-finally-available/1032)
**Author:** [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Replies:** 6\ **Last updated:** [March 3, 2017, 4:57pm UTC](https://discuss.bitrise.io/t/2fa-two-factor-auth-two-step-auth-is-finally-available/1032 "2017-03-03T16:57:16Z")
We are pleased to announce that 2FA (two-factor authentication or two step authentication) is available on Bitrise.io :tada: Two-factor authentication gives another layer of security to your account, so if your password… --- ## [Increase the session timeout on bitrise.io](https://discuss.bitrise.io/t/increase-the-session-timeout-on-bitrise-io/65)
**Author:** [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\ **Replies:** 1\ **Last updated:** [January 2, 2017, 4:13pm UTC](https://discuss.bitrise.io/t/increase-the-session-timeout-on-bitrise-io/65 "2017-01-02T16:13:05Z")
Related feature request: https://bitrise.uservoice.com/forums/235233-general/suggestions/11350275-add-an-option-to-increase-the-session-timeout