Mercurial Hub
You set up a mercurial hub by hosting a shared repo on one central server. Then you grant team members read and write permissions over SSH or HTTPS. Most teams start by sharing one admin account or adding public keys to a server. That simple setup works at first, but broad roles soon create big security risks. When every developer has full server permissions, one bad command can wipe out code history. How a native mercurial hub handles user roles Mercurial works as a distributed tool, so ever
AWS Security Hub: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a mercurial hub by hosting a shared repo on one central server. Then you grant team members read and write permissions over SSH or HTTPS. Most teams start by sharing one admin account or adding public keys to a server. That simple setup works at first, but broad roles soon create big security risks. When every developer has full server permissions, one bad command can wipe out code history.
How a native mercurial hub handles user roles
Mercurial works as a distributed tool, so every user has a full local copy. Teams still need one central place to share changes and run build jobs. This central server acts as your mercurial hub for daily work. Admins set up either a web server or an SSH host to receive pushes.
With HTTPS, the web server checks user passwords against an access list. With SSH, the server checks public keys stored in a local folder. Admins can also add server hooks to check incoming changes before saving them. These hooks run small scripts when someone pushes new commits to the central repo. You can use hooks to block pushes to main branches or check commit messages. The native tools handle basic file sync and user login checks well.
What native repo permissions leave open
Native server setups decide who can log in and which repos they can read. Still, they do not control what users or build scripts do during a session. When developers log into the host server via SSH, they often get shell access. Even restricted keys still trust the client machine that holds the private key.
Shared deploy keys create an even bigger gap for growing engineering teams. Teams place these long-lived keys inside build apps and test servers. If a key leaks, an attacker gains full read and write power. Standard server logs only show which key logged in, not which person ran a command. When a script queries a database during a build, raw data can also leak. Standard repo rules cannot rewrite emails, phone numbers, or card numbers in query results.
AWS Security Hub: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
How to tighten security on your central repo server
To reduce risk, teams must separate code sync from direct server shell access. First, remove shared SSH keys and give every person a unique identity. Connect your central repo host to your main team login provider. This step makes sure that when someone leaves the team, their access ends right away.
Next, limit what automated build scripts can do when they pull code. Build apps only need read permissions for specific branches, not full write power. You should also check every command that runs on the host server itself. Watching active sessions helps you spot bad scripts before they break production systems. Finally, mask sensitive fields like national IDs in data results so logs stay clean.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
What is the difference between a local repo and a mercurial hub?
A local repo lives on one developer machine for writing and testing code. A mercurial hub is the central server where the whole team pushes finished work.
Should our team use SSH or HTTPS for central repo connections?
Both options work well, depending on how your team manages user logins. HTTPS fits well with central login tools, while SSH works well with key checks.
How can we stop users from pushing secrets to the central repo?
You can add pre-commit hooks on the central server to scan incoming code changes. These scripts block any push that contains private keys or database passwords.