wif.tax

Reco

F Reco Dynamic SaaS Security (SSPM / ITDR)

Reco's platform API takes only a static API access key, made in the UI, which can be bound to a role, an expiry and an IP allowlist; the expiry is optional and defaults to never. Into your SaaS it connects through its own apps for Google Workspace, Microsoft 365, GitHub, Slack and Salesforce and an AWS role with external ID, but Okta, GitHub Enterprise and many others want pasted secrets.

Docs: docs.reco.ai · Checked 2026-10-13 · source YAML · dispute via PR

Inbound F

How a workload running anywhere authenticates to this product.

Static API access key created by an admin under the API Access Keys tab in the Reco web UI, optionally tied to a role, an expiration date and permitted IPs. No federation, OAuth client-credentials or short-lived token path is publicly documented.

Reco's API reference and admin docs (readme.reco.ai) are password-protected, so the API's auth schemes, any key-management endpoints and any last-used display could not be verified. The key-creation details (role, optional expiry, optional permitted IPs) come from BlinkOps' public connector guide for Reco, not from Reco itself. The vendor help center (docs.reco.ai) failed TLS handshakes on 2026-10-13 from curl, WebFetch and Chrome, so its pages are cited from Internet Archive snapshots (January 2025, September 2024). Reco describes itself as API-based; no customer-deployed agent or collector that would carry its own credential back to Reco was found in the public docs. Graded F on public evidence; it would move to D if Reco documents a key-management API and last-used timestamps.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

Admin consent / OAuth install of Reco's own apps for Google Workspace ("RecoLabs Data Connector App"), Microsoft 365 / Entra ID, GitHub (GitHub App), Slack ("Reco Main") and Salesforce (Reco's connected app, authorized as a dedicated integration user), plus an AWS cross-account IAM role with external ID for the S3 bring-your-own-bucket export. Okta, GitHub Enterprise and many security-tool connectors want a pasted client secret, PAT or API key.

Connectors checked. Keyless (vendor app consent or install): Google Workspace, Microsoft AD / Audit / Apps (admin consent to Reco's app), GitHub (GitHub App), GitLab (OAuth authorize), Slack Apps and Slack Enterprise (Reco's Slack app), Salesforce (OAuth consent to Reco's connected app as an API-only integration user), and AWS S3 bring-your-own-bucket (cross-account role, Reco account 495155430317, external ID). Static secrets handed over: Okta (client ID + client secret from the Reco OIN API Service Integration, or an SSWS API token), GitHub Enterprise (classic PAT with repo and admin:org scopes), Microsoft "use your own application" (optional; customer app client secret), Datadog (API key + application key, with scoping guidance), Wiz (service-account client secret). Under the cohort rule an Okta OIN service app counts as keyless, but in practice the customer still copies a long-lived client secret out of Okta and pastes it into Reco. No AWS, GCP or Azure cloud-account posture connectors were found in the public help center; the S3 export is the only cloud-account connector. Help center pages are from January 2025 archive snapshots and may lag the current product.

Hygiene for any static credential the product still issues

✗ Expiry enforceable
Expiry is settable per key but defaults to never; no org-level policy forcing an expiry is publicly documented.
  • docs.blinkops.com checked 2026-10-13
    “(Optional) Enter an Expiration Date. If left blank, the key never expires.”
✗ Rotation via API
Only UI key creation is publicly documented. The API reference is password-protected, so an API for creating and revoking access keys could not be verified.
  • readme.reco.ai checked 2026-10-13
    “This page is password-protected.”
✓ Scoped keys
Each key carries its own role (built-in or custom RBAC role) and an optional source-IP allowlist. Source is a third-party (BlinkOps) connector guide; Reco's own RBAC page is gated.
  • docs.blinkops.com checked 2026-10-13
    “For the Role, you can choose from Reco’s built-in roles, or create a custom role for a more fine-grained resolution.”
  • docs.blinkops.com checked 2026-10-13
    “(Optional) Enter Permitted IP Addresses. If left blank, access is allowed from any IP.”
✗ Last-used visible
No public evidence that Reco shows when an API access key was last used.
  • docs.blinkops.com checked 2026-10-13
    “The new key appears in the list with Status: Active.”
✗ Leak revocation
Reco does not appear in GitHub's supported secret-scanning patterns, partner or user.

Notes

Docs are partly gated: Reco's API and admin documentation (readme.reco.ai) is password-protected, and the public help center (docs.reco.ai) was unreachable on 2026-10-13 (TLS handshake failure), so help-center receipts are Internet Archive snapshots and key-creation details come from a BlinkOps integration guide. A newer live Okta guide may describe the SSWS path in more detail than the September 2024 snapshot cited here. The inbound grade is what the public receipts support; a gated key-management API with last-used timestamps would lift it to D.

Badge

wif.tax grade F

[![wif.tax grade](https://wif.tax/badge/reco-saas-security.svg)](https://wif.tax/p/reco-saas-security/)