workspace

Settings

Runtime boundaries, approvals, secrets, and production hardening controls.

Demo mode

Enabled

Runs deterministic local audits without external API keys.

Manual

Repo writes, pull requests, and deploys require explicit user approval.

Env only

Private tokens are read from environment variables and never printed.

Read-only demo

Production mode should run untrusted repos in disposable containers.