Security & access
This section explains who can do what on Selfmade Ninja Labs, and how the platform keeps your account, your labs and your AI connections safe. It covers users and administrators, in the dashboard and through MCP.
Start with the question you have
| Question | Read |
|---|---|
| Who can see, run or change my lab? What do Viewer, Operator and Manager mean? | Roles and permissions |
| What can an organization member, clan admin or club mod do? | Roles and permissions |
| How does someone become an administrator, moderator or faculty member? | Roles and permissions → Platform roles |
| How long do I stay signed in? What if someone else has access? | Sign-in and sessions |
| Is my lab on the internet? How does the device tunnel work? | Secure tunnels and networking |
| Is it safe to connect ChatGPT, Claude or another assistant? What can it do? | How MCP connections are secured |
| How is cheating prevented? | Fair play |
| What data does the platform hold about me? | Your data |
The principles
- Private by default. A new lab has no public address. It is managed only by you from the dashboard, and reached over the private tunnel. Publishing it to the internet is always your choice.
- Least privilege. Sharing uses roles, from Viewer upwards, and single extras, so you can give exactly the access someone needs and no more.
- One set of rules everywhere. The dashboard and AI assistants go through the same permission checks. Connecting an assistant never adds access.
- Enforced on the server. Permissions, limits and competition rules are checked by the platform, not by your browser, so editing a page or a request does not get around them.
- Recorded. Sharing changes, admin actions, impersonation and every AI tool call are recorded, so you can always see what happened.
- Revocable. Sessions, shares, devices, SSH keys and AI clients can each be ended from the dashboard in one step.
Your security checklist
- Turn on two-factor authentication at your sign-in provider (GitLab, GitHub, Google, or your organization's single sign-on).
- Protect every service your lab listens on with a password, or bind it to
localhost. See Secure tunnels and networking. - Review Account Settings → Security now and then: end sessions and disconnect AI clients you do not recognise.
- Delete devices and SSH keys you no longer use.
- Share with the lowest role that works; give VS Code / terminal access only to people you fully trust.
- Publish only the ports that need to be public.
- Never paste passwords, private keys, tunnel files or tokens into a chat, including with an AI assistant.
For administrators
| Task | Read |
|---|---|
| Grant or revoke admin, moderator or faculty | Users → Admin access |
| See every share, set platform-wide minimum roles, read the audit log | Access control |
| Set plans and per-account limits | Users |
| Impersonate a user for support | Users → Impersonation |
| Use the admin tools through MCP | Admin tools over MCP |
| Configure integrity for assessments | Assessments and integrity |
If you find a way to reach something you should not, or see activity you do not recognise, stop and tell your platform administrator, or the Selfmade Ninja team through the SNA Community. Please do not test it further on other people's accounts.
In this section
Roles and permissions
Every role on the platform in one place — platform roles, plans, sharing roles, organization, clan and club roles — and how they combine, in the dashboard and through MCP.
Sign-in and sessions
How your account is protected — where you sign in, how long a session lasts, what stops forged requests, and what to do if you think someone else has access.
How MCP connections are secured
How an AI assistant connects to your labs — HTTPS only, OAuth sign-in with your approval, the same permissions as you, no open ports on your lab, full history, and one-click revoke.
Secure tunnels and networking
Why labs are private by default, how the encrypted device tunnel works, how keys are handled, and what you expose when you publish.