Secrets that stay secret
Secrets, sandboxing and the security model
Letting an AI write and run code only works if the runtime around it is locked down. Here is what that means in practice.
-
01
Secrets are never in the code
API keys and environment variables are stored encrypted and injected at runtime. They do not appear in your source, in build logs, in the frontend bundle or in prompt history.
-
02
Builds run in an isolated sandbox
Each build runs in its own sandbox with CPU, memory, disk and time limits and restricted network access, so a runaway build stays contained.
-
03
Three separate domains
The platform, the previews and the published apps each live on their own domain. A generated app cannot set a cookie on the platform, and previews never mix with production.
Start on the free plan. Upgrade when it earns its keep.
No credit card. 350 bonus AI Credits during launch.