Best practices
Stay safe while you ship
CloudCMD holds powerful access to your infra. These habits keep that power on your side.
Master password
- Use a long, unique passphrase you do not reuse elsewhere.
- Prefer a password manager to generate and store it — we never store your master password and only you know it; neither it nor derived keys is ever transmitted to us, and we cannot recover it.
- Lock the vault when you step away; it also auto-locks after idle time.
- If you forget it, we cannot recover your Secure Data — keep a backup of the passphrase offline.
Credential hygiene
- Prefer SSO (AWS IAM Identity Center, Google Cloud OAuth) over long-lived access keys when you can.
- Scope tokens to least privilege — read-only where possible.
AI command assistance
- Treat prompts like chat with a third-party model: do not include passwords, private keys, or tokens.
- Read generated commands before you run them — especially anything destructive.
- Turn AI off in settings if you are on a sensitive network or policy forbids outbound model calls.
Devices & sessions
- Only install signed CloudCMD builds from our download page or auto-updater.
- Deactivate devices you no longer use so they stop syncing your encrypted workspace.
- If a laptop is lost: revoke OAuth at Google / AWS / Tailscale, then change your master password on a trusted device.