Backstage Security

Backstage security relies on the underlying platform (Kubernetes, hosting infrastructure) and plugin ecosystem. Core provides authentication framework; plugins implement authorization, secrets, and compliance.

Core supports OAuth/OIDC (GitHub, GitLab, Google, Azure, Okta, Auth0). Custom auth providers via plugin. RBAC plugin (community) provides role-based access. Permission framework for plugin-level authorization. No built-in ABAC — requires custom implementation.

Backstage does not manage secrets directly. Plugins integrate with HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, CyberArk. TechDocs can reference secrets via templating. Scaffolder actions can inject secrets into generated repositories.

200+ plugins with varying security maturity. Official plugins (Kubernetes, ArgoCD, Datadog, PagerDuty) maintained by community. Third-party plugins require vetting. Plugin signature verification via package manager. Sandbox plugins in separate processes/containers.

Core packages signed and published to npm. Renovate/Dependabot for dependency updates. Software Bill of Materials (SBOM) via plugins. Plugin marketplace shows maintenance status and security advisories.

CNCF graduated project with open governance. No vendor lock-in. Self-hosted deployment enables data residency, air-gapped operation, and custom compliance controls. Audit logging via backend plugins. Roadie (managed) adds SOC 2, SSO, SCIM.