#What's Changed

[Feature] A new Service Tokens page on every project issues credentials for GitHub Actions, Docker, Kubernetes and Lambda. The raw token is shown exactly once and stored only as a SHA-256 hash, so it cannot be recovered or re-displayed.
[Feature] Tokens carry three independent scopes — list keys, reveal decrypted values, and modify keys — capped by the role of whoever creates them. A token that lists key names for a drift check is a much smaller liability than one that decrypts them, so those are separate grants rather than a single “read”.
[Feature] A token can be pinned to one environment, so a staging pipeline's credential cannot reach production secrets. The pin replaces the environment in every request rather than acting as a default the caller can override — on reads and on writes alike, including the request body.
[Feature] A token can be restricted to a list of IPv4 or IPv6 CIDR ranges. A request from anywhere else is refused, and so is one whose source address cannot be determined at all. Addresses are compared in the forms a proxy actually writes — IPv4-mapped IPv6, a fully expanded IPv6 address, and an appended source port all match the range they belong to, so a correctly configured runner is never locked out by formatting.
[Security] Every service token expires — between 7 and 365 days, defaulting to 90. There is deliberately no never-expires option, so a forgotten pipeline credential cannot outlive the pipeline. The list warns in amber inside the last week and in red once a token has lapsed.
[Security] Service tokens reach the key endpoints and nothing else. Project settings, members, invitations, encryption configuration and token creation itself all reject them, so a leaked CI credential cannot add a collaborator, rotate your vault key, or mint a replacement for itself.
[Security] A token belongs to the project rather than to the person who created it, and keeps working after they leave — a deploy should not break because an engineer changed teams. Because that also means removing a member does not revoke their tokens, any token whose creator is no longer a member is flagged for review.
[Improvement] Audit logs record machine traffic under its own source with the token's name, including refusals. An expired token, a call outside its scope, or a request from an address that is not on its allowlist now leaves a visible line instead of a silent 401.
[Improvement] Exporting an entire environment is the most sensitive thing a token can do, so when a machine does it the project's owners and admins are notified, with the token named — rather than a single engineer who may have created the token months ago.