Skip to content

Secrets that stay secret

Secrets, sandboxing and the security model

Letting an AI write and run code only works if the runtime around it is locked down. Here is what that means in practice.

Secrets are never in the code

API keys and environment variables are stored encrypted and injected at runtime. They do not appear in your source, in build logs, in the frontend bundle or in prompt history.

Builds run in an isolated sandbox

Each build runs in its own sandbox with CPU, memory, disk and time limits and restricted network access, so a runaway build stays contained.

Three separate domains

The platform, the previews and the published apps each live on their own domain. A generated app cannot set a cookie on the platform, and previews never mix with production.

Your first app is a sentence away.

Start on the Free plan — no card, no trial countdown. Describe what you want and watch it get built.

No credit card · Publish on the free plan · Cancel anything any time