Part

Secrets

You might say: scoped credentials, runtime tokens, protected variables

Credentials made available to a run through a controlled scope. The runner receives only the values and permissions the task needs.

What it does
Lets a run authenticate to required services while reducing the value of a stolen workspace or log.
Ask
Which credential reaches this run, for how long, and can its value or authority leave the boundary?
Typical
Use repository, environment, or organization scopes. Prefer short-lived tokens and OIDC where the target supports it. A proxy can add the value to outgoing requests, so the agent uses the credential without seeing it.
Trouble
A secret is available to an untrusted change, appears in output, persists on disk, or grants more API access than the task needs.

What to look for

  1. A named secret reference in the run configuration
  2. A masked value in logs and a permissions scope
  3. An OIDC or short-lived token exchange

Connections

Sources

  1. GitHub, Using secrets in GitHub Actions, Using secrets in a workflowWith the exception of `GITHUB_TOKEN`, secrets are not passed to the runner when a workflow is triggered from a forked repository.
  2. GitHub, Using secrets in GitHub Actions, Using secrets in a workflowTo provide an action with a secret as an input or environment variable, you can use the `secrets` context to access secrets you've created in your repository.
  3. OpenAI, OpenAI-hosted sandboxes, Set environment variablesFor secrets, use vault credentials to keep the real values outside the sandbox.
  4. Kody, Documentation, CredentialsCode names a credential. Kody puts the value into the outgoing request at the network boundary, only for the hosts that credential allows, and only over HTTPS. Agents, packages, logs, and tool output never see it.
  5. Kent C. Dodds, You Own the Outcome: Product Engineering in the Age of AI, Design the playgroundAgents should be able to use credentials without ever seeing them. This is non-negotiable once agents are acting on your behalf.

Use it on your project

teardown-apply: hold "Secrets" (secrets) from the teardown at https://teardownatlas.com/software-factory/ against my project

Paste it into a coding agent that has the teardown skills.

An AI agent wrote this map with the teardown skill. It can contain errors: check the sources before you rely on a part. About and legal