Security & Privacy — PAPI Config Cloner

ℹ️

Short version The credential you paste is held in server process memory only, for the life of that process, and is never written to disk, logged, or sent anywhere except Akamai's API. This tool is designed to be run by a single person at a time — see Shared/hosted use below before putting it anywhere other than your own machine.

🗂️ What data this tool touches

Two kinds of sensitive data pass through this tool while it's running:

Your Akamai EdgeGrid API credential — client_token, client_secret, access_token, and API host. This is whatever access that credential has been granted in Akamai Identity & Access Management: typically read/write to Property Manager (PAPI) across whichever accounts and groups it's scoped to.
Property Manager data fetched using that credential — account, group, contract, and property listings, and rule trees for the properties you clone.

🧠 How credentials are stored

Credentials live in a single in-process Python object (app/state.py) for as long as the server process is running. Specifically:

Never written to disk, a database, a cookie, or browser storage.
Never included in application logs. The only thing written to stdout per request is the HTTP method, path, and status code (standard web server access logging) — and, since a recent update, the raw error body Akamai returns on a 403 (to help diagnose permission problems). That error body comes from Akamai's response, not your request, so it never contains your credential.
Cleared immediately when you click Clear credentials, and wiped entirely when the process restarts (a redeploy, a container restart, or you stopping the local process).
Never sent anywhere except directly to the Akamai API host you configured. There is no telemetry, analytics, or error-tracking service wired into this tool, and nothing is sent to its author.

🚫 What this tool structurally cannot do

Activation endpoints (.../versions/{v}/activations) are blocked at the HTTP client layer in app/akamai_client.py, not just hidden from the UI — every outgoing request path is checked against that rule regardless of which code path calls it. This tool can create and edit property versions; it cannot push anything to staging or production.

👥 Shared / hosted use

⚠️

Not multi-user safe All state — the active credential, the fetched account index, everything — lives in one shared in-memory object for the whole process. There is no per-visitor session. If this were run as a shared service reachable by more than one person, whoever pastes a credential makes it usable by every other visitor until someone clears it, and two people using it at once would stomp on each other's in-progress state. This is by design for a single-operator tool, not an oversight to route around.

Because the repository is public, we recommend running it on your own machine (see Run it locally) rather than pointing it at a shared hosted instance. If you do need to host it somewhere reachable over the network, put real access control in front of it — HTTP Basic Auth, an IP allowlist, or a private tunnel (Tailscale, SSH tunnel) — and treat it as single-user even then.

Practical recommendations

Scope the Akamai API client you paste in as narrowly as you can in Identity & Access Management (only the accounts/groups you actually need) rather than reusing a broad administrative credential.
Click Clear credentials when you're done with a session.
Prefer running it locally, one person, one process — see the local setup guide.

🗑️ Data retention

Nothing is persisted to disk at any point — not credentials, not the account/property index, not rule trees. All of it lives in memory only and disappears the moment the process stops, restarts, or you clear credentials. There is no database and nothing to delete after the fact, because nothing was ever saved.