Secrets that stay secret
Secrets, sandboxing and the security model
Letting an AI write and run code only works if the runtime around it is locked down. Here is what that means in practice.
Secrets are never in the code
API keys and environment variables are stored encrypted and injected at runtime. They do not appear in your source, in build logs, in the frontend bundle or in prompt history.
Builds run in an isolated sandbox
Each build runs in its own sandbox with CPU, memory, disk and time limits and restricted network access, so a runaway build stays contained.
Three separate domains
The platform, the previews and the published apps each live on their own domain. A generated app cannot set a cookie on the platform, and previews never mix with production.
Your first app is a sentence away.
Start on the Free plan — no card, no trial countdown. Describe what you want and watch it get built.
No credit card · Publish on the free plan · Cancel anything any time