Credentials

Git tokens, SSH keys and model sign-ins stay on the host. The agent asks; the host acts.

Keys never enter the sandbox

When the policy allows an action, the host performs it for the agent. The token or key is never copied into the microVM, so an agent that is prompt-injected has nothing to exfiltrate.

Git gateway

Git operations go through a gateway on the host that applies the sandbox's git policy. The policy can change on a live sandbox:

Short-lived sandbox tokens

When a sandbox needs to call the platform API it gets a short-lived token scoped to its organisation and run, which expires on its own.

Redaction

Secrets are redacted from the agent log. Files such as .env can be kept out of the sandbox entirely with an fs deny rule; see Policies.

Remote machines

Work on a remote machine uses certificates valid for at most 15 minutes, bound to one sandbox, machine and policy hash. See Security model.

Related: Policies · Security model · Install