> ## Documentation Index
> Fetch the complete documentation index at: https://boxrouter.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How Actions Security Works

> See which jobs BoxRouter runs, what a job can reach, and why your secrets stay in GitHub.

BoxRouter runs a job only when the repository is private, a workspace administrator turned it on, and the job came from a trusted trigger. Anything else is refused before a sandbox exists.

## Which Jobs Run

| Condition | Runs | Refused With |
| - | - | - |
| Repository is private | Yes | `repository_not_private` for a public one |
| Repository is turned on in BoxRouter | Yes | `actions_disabled` |
| Trigger is a push, a manual or API dispatch, or a pull request from a branch in the same repository | Yes | `untrusted_workflow_origin` for a fork pull request |

A fork's author controls the workflow code. The job would run on a machine your workspace pays for, so BoxRouter refuses fork pull requests. A refused job never starts. The refusals in this table leave the job queued on GitHub until you cancel it or GitHub times it out. Only an unfunded job (`funding_unavailable`) has its run cancelled for you, and only when every unfinished job in the run is a BoxRouter job. The run page shows the refusal code, and [Troubleshoot Actions](https://boxrouter.ai/docs/actions/troubleshooting.md#refusals) lists each one.

## What a Job Can Reach

Each job gets a new sandbox from the BoxRouter runner image. BoxRouter requests its deletion when the job ends. Steps run as the non-root user `runner`. The workflow's [`permissions` block](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions) limits what the job's `GITHUB_TOKEN` can do on GitHub.

BoxRouter registers each runner with GitHub as single-use, so GitHub cannot assign it a second job. [How Actions works](https://boxrouter.ai/docs/actions/how-it-works.md) explains GitHub's cache and artifacts.

## Where Secrets Live

GitHub stores repository, environment, and organization secrets and provides referenced secrets to the job's runner. Workflow code can send a secret elsewhere or save it in an artifact; deleting the sandbox does not remove those copies.

Your workflow needs no BoxRouter API key or provider key. GitHub masks known secrets in job logs, but redaction can fail for transformed values. Avoid printing secrets; see [GitHub's security guidance](https://docs.github.com/en/actions/reference/security/secure-use#mask-sensitive-data).

The [run page](https://boxrouter.ai/docs/actions/runs.md) shows each job's sandbox cleanup as `pending`, `confirmed` or `unknown`. `pending` means deletion hasn't finished; `unknown` means BoxRouter couldn't verify deletion. Assume the sandbox still exists until its cleanup status reads `confirmed`.

## Control Access

* Install the GitHub App on selected repositories only, and keep the BoxRouter switch off for repositories that should not use it.
* To stop Actions entirely, remove the App in GitHub's installation settings. That stops new jobs from starting. Cancel running jobs from the run page.
* Protect sensitive deployments with GitHub environments that require approval. GitHub does not release a job that waits for approval, so it stays queued until approved.

## Next Steps

> [card] [Connect GitHub](https://boxrouter.ai/docs/github/connect.md)
>
> Limit which repositories the App reaches.

> [card] [How Actions Works](https://boxrouter.ai/docs/actions/how-it-works.md)
>
> What happens to each job.

> [card] [Troubleshoot Actions](https://boxrouter.ai/docs/actions/troubleshooting.md)
>
> Fix a refused label or a queued job.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.