Security & access

This section explains who can do what on Selfmade Ninja Labs, and how the platform keeps your account, your labs and your AI connections safe. It is for users and administrators, and covers both the dashboard and MCP (the way AI assistants connect to your labs).

Start with the question you have

Question	Read
Who can see, run or change my lab? What do Viewer, Operator and Manager mean?	Roles and permissions
What can an organization member, clan admin or club mod do?	Roles and permissions
How does someone become an administrator, moderator or faculty member?	Roles and permissions → Platform roles
How long do I stay signed in? What if someone else has access?	Sign-in and sessions
Is my lab on the internet? How does the device tunnel work?	Secure tunnels and networking
Is it safe to connect ChatGPT, Claude or another assistant? What can it do?	How MCP connections are secured
How is cheating prevented?	Fair play
What data does the platform hold about me?	Your data

The principles

1. Private by default. A new lab has no public address. Only you manage it, from the dashboard, and you reach it over the private tunnel. Publishing it to the internet is always your choice.
2. Least privilege. Sharing uses roles, from Viewer upwards, and single extras, so you can give exactly the access someone needs and no more.
3. One set of rules everywhere. The dashboard and AI assistants go through the same permission checks. Connecting an assistant never adds access.
4. Enforced on the server. Permissions, limits and competition rules are checked by the platform, not by your browser, so editing a page or a request does not get around them.
5. Recorded. Sharing changes, admin actions, impersonation and every AI tool call are recorded, so you can always see what happened.
6. Revocable. Sessions, shares, devices, SSH keys and AI clients can each be ended from the dashboard in one step.

Your security checklist

• Turn on two-factor authentication at your sign-in provider (GitLab, GitHub, Google, or your organization's single sign-on).
• Protect every service your lab listens on with a password, or bind it to localhost. See Secure tunnels and networking.
• Review Account Settings → Security now and then: end sessions and disconnect AI clients you do not recognize.
• Delete devices and SSH keys you no longer use.
• Share with the lowest role that works; give VS Code / terminal access only to people you fully trust.
• Publish only the ports that need to be public.
• Never paste passwords, private keys, tunnel files or tokens into a chat, including with an AI assistant.

For administrators

Task	Read
Grant or revoke admin, moderator or faculty	Users → Admin access
See every share, set platform-wide minimum roles, read the audit log	Access control
Set plans and per-account limits	Users
Impersonate a user for support	Users → Impersonation
Use the admin tools through MCP	Admin tools over MCP
Configure integrity for assessments	Assessments and integrity

Report a security problem

If you find a way to reach something you should not, or see activity you do not recognize, stop and tell your platform administrator, or the Selfmade Ninja team through the SNA Community. Please do not test it further on other people's accounts.

In this section

📄️Roles and permissions

Every role on the platform in one place — platform roles, plans, sharing roles, organization, clan and club roles — and how they combine, in the dashboard and through MCP.

📄️Sign-in and sessions

How your account is protected — where you sign in, how long a session lasts, what stops forged requests, and what to do if you think someone else has access.

📄️How MCP connections are secured

How an AI assistant connects to your labs — HTTPS only, OAuth sign-in with your approval, the same permissions as you, no open ports on your lab, full history, and one-click revoke.

📄️Secure tunnels and networking

Why labs are private by default, how the encrypted device tunnel works, how keys are handled, and what you expose when you publish.