Secrets infrastructureAccess control
Runtime injection
Deliver a resolved value to a child process at the final-use boundary without printing it.
Runtime injection — contract and behavior
- Runtime injection keeps secret values out of shell history, command arguments, JSON responses, and ordinary logs.
- The child process receives only the requested values and inherits no general vault authority.
- Injection should happen immediately before execution so long-lived plaintext files or environment snapshots are unnecessary.
- Exit status and audit metadata can be recorded without recording injected values.