Secrets stay out of the conversation
Bot tokens, the CLI token, webhook secrets and third-party keys live in a vault. The agent sees the variable name, its purpose and whether it is configured.
Secrets are configuration, not context. They are excluded from prompts, conversation history, logs, analytics, build output, commits and error messages, and only the trusted runtime or deployment service can read them.
That means the agent can tell you `TELEGRAM_BOT_TOKEN` is configured and still write code that reads it. It cannot leak the value into a handler, a log line or a review comment.
Vaulted
Encrypted and scoped to the project.
Prompt-safe
Values never enter the model context or conversation history.
Rotatable
Change a secret without rewriting the code that uses it.
Explore more
Describe your next change.
The agent plans, writes, validates, and deploys it to Telegram.