Encryption & Security
Aethrix protects sensitive data in automation projects and workspaces using AES-GCM encryption.
Project Encryption
Automation projects (.aprj files) can be protected with an encryption key. When encrypted:
- All stored credentials and password variables are encrypted at rest
- The project file cannot be read without the key
- Keys are never stored together with the project file
Setting a Project Key
- Right-click the project node in the Test Automation tree.
- Choose Set Encryption Key (available only while the project is loaded and not already protected).
- Enter the key in the Set Password dialog and confirm.
- The project is marked as protected (a lock icon appears on the project node).
Removing a Project Key
- Right-click the project node and choose Remove Encryption Key (available only for already-protected projects).
- Enter the current key to confirm. The project is decrypted and the protection is lifted.
Opening an Encrypted Project
- IDE: When you open an encrypted
.aprj, Aethrix prompts for the password (the Provide Password dialog). The entered key is base64-encoded and used to decrypt the project. - CLI: Pass the key with the run command:
aeth run MyProject.aprj --key "my-secret-key"
Credential Storage
| Storage Type | Encryption |
|---|---|
| Password Variables | AES-GCM encrypted in the project/workspace |
| OAuth2 Client Secrets | AES-GCM encrypted |
| Connection Strings | AES-GCM encrypted |
| API Keys | AES-GCM encrypted |
Variables of type Password are always masked in the UI (••••••) and encrypted at rest. Plain-text variables are stored as-is. Authentication profiles (HTTP Basic, Bearer Token, API Key, OAuth2, Kafka SASL) configured in the Environment Management view are also encrypted when the project is protected.
Rotating Encryption Keys
To change the encryption key for a project, use the CLI:
aeth rotate-credentials MyProject.aprj \
--key "current-key" \
--new-key "new-key" \
--output ./rotated-project.aprj
This decrypts all credentials with the old key and re-encrypts them with the new key.
Encrypting Secrets for CI/CD
Use the aeth encrypt command to encrypt individual secrets for use in CI/CD pipelines:
aeth encrypt "my-secret-password" --key "base64-encryption-key"
Output:
Encrypted Secret: <base64-encrypted-value>
IV: <base64-initialization-vector>
Store these values in your CI/CD secret store and pass them as environment variables.
TLS / SSL Settings
Configure TLS version requirements in Settings → Security (changes take effect after the application restarts):
| Setting | Default | Description |
|---|---|---|
| TLS 1.0 | Disabled | Legacy — disable unless required |
| TLS 1.1 | Disabled | Legacy — disable unless required |
| TLS 1.2 | Enabled | Minimum recommended version |
| TLS 1.3 | Enabled | Current standard |
Hide Sensitive Data
Enable Hide Sensitive Data in Settings → Security to mask sensitive values in request/response logs, diagnostic panels, test reports, and message history. When active, passwords, tokens, and API keys are replaced with masked output.
Disable Hide Sensitive Data only temporarily while investigating a specific case — it exposes secrets in logs and reports.