Skip to content
SkiMasque
Sign InGet Started

Give every workload exactly the network access it needs.

SkiMasque provides identity-aware, least-privilege network access for developers, CI/CD workloads and coding agents.

Grant a policy-bounded session for the destinations the job needs.

Get StartedUse SkiMasque ConnectWatch the workflow

ONE JOB. ONE DESTINATION. TEMPORARY ACCESS.

PRIVATE NETWORK CI WORKLOAD deploy job CONTROL PLANE identity + policy GATEWAY scoped session PRIVATE DATABASE db.prod:5432 Other services

Only the permitted database is reachable. Access closes when the session expires.

Simulated example · 20 minutes compressed into seconds

SkiMasque Connect

Connect GitHub Actions to your private infrastructure.

Give your workflow the access it needs with skimasque-dev/connect@v2.

Authenticate with GitHub OIDC and reach the destinations your policy allows. No long-lived access token to store in repository secrets.

This example uses proxy mode for Terraform. Replace the gateway and audience with your own, and configure a policy for your workflow before running it.

.github/workflows/deploy.yml
permissions:
  id-token: write          # the job mints its own OIDC token
  contents: read

steps:
  - uses: skimasque-dev/connect@v2
    with:
      proxy: gateway.skimasque.com:443
      audience: https://gateway.skimasque.com
      mode: proxy
      application: terraform

  - run: terraform apply -auto-approve   # egresses through the gateway

Set Up ConnectView on GitHub

Your deployment shouldn't need the whole network.

A deployment may need to reach one database.

That doesn't mean it should automatically gain access to:

  • every internal API
  • every database
  • administrative services
  • monitoring systems
  • unrelated production infrastructure

Traditional solutions often solve this by putting the workload somewhere inside the network.

SkiMasque checks the workload's identity and requested destination against policy before the gateway opens a tunnel.

Traditional access

  1. CI job
    potential
  2. VPN
    potential
  3. Whole network
    potential
  4. Everything on it
Traditional access: a CI job connects through a VPN to the whole network.

SkiMasque

  1. CI job
    proves identitycontrol plane
  2. Identity
    checkedcontrol plane
  3. Policy
    active
  4. Sessionexpires ACTIVE
    active
  5. One destinationdb.prod:5432
SkiMasque access: a CI job proves an identity, a policy allows one destination, and a temporary session carries the traffic.
Traditional access reaches a whole network; SkiMasque reaches one destination for a limited time.

Network access as a capability.

Specify who is asking, what application they name, where they need to connect, and the session limits.

  1. WHOacme/widget · deploy-production
  2. WHATterraform
  3. WHEREdb.prod:5432
  4. LIMITS20m · 100 Mbps
    active
  5. NETWORK ACCESS ACCESS GRANTED
A policy answers four questions: who is asking, what they are running, where they want to go, and the limits on the access. The answer is network access.
  • acme/widget
  • terraform
  • db.prod:5432
  • 20m
  • 100 Mbps
ACCESS GRANTED

policy production-deploy matches

What you get

Identity-aware

Know what workload or developer is requesting access.

Least privilege

Grant access to specific destinations instead of entire networks.

Short-lived

Credentials expire; agent sessions also close active tunnels at expiry.

Policy-driven

Define access declaratively.

Developer-friendly

Run a command with the access its policy grants: skimasque exec --policy production -- terraform apply. Or use skimasque connect, or the GitHub Action in CI.

Real network access

Built around MASQUE, HTTP/3, and QUIC.

Network access should be temporary.

Define the access your workloads need.

Test the policy, then run a command with the access it grants.

Create Your First Policy