// ENVIRONMENT AND SECRETS
Secret Values and Encryption
How values are stored, who can read them, and what's actually visible in the dashboard.
All environment variable values, Git OAuth tokens/PATs, and object storage credentials are encrypted at rest with AES-256-GCM before being written to the database. The encryption key lives only in the platform's own server-side configuration, never in application code paths you can reach.
In the dashboard, a saved user environment variable's value is never redisplayed — you'll see *** after saving. If you need to confirm or rotate a value, overwrite it rather than trying to retrieve the old one.
There's currently no scoped/least-privilege model within a project (anyone with write access to a project's environment variables can set or overwrite any of them) and no built-in secret rotation tooling — rotate manually by updating the value and redeploying.