Choose the secret and artifact boundary

Runtime Secrets protect sensitive values from model-visible output. Artifact links need a separate audience check.

Use an Environment Variable for non-sensitive configuration the agent may read. Use a Runtime Secret for a password or token: Cursor injects it as an environment variable but replaces its value with [REDACTED] in model-visible tool output, the transcript and commits. A person controlling the VM through its terminal can still reveal the value. Build Secrets exist only during a Docker build. An environment-scoped secret reaches every repository in that environment, not one task. Computer use lets the agent drive its VM desktop and browser. Remote desktop lets you take control and hand it back. Screenshots, videos and log references show what the agent tested. Direct GitHub embeds are optional, and their long URLs are open without authentication. Restricted egress must name the exact artifact upload host. Secrets remain until removed. Conversations and artifacts remain indefinitely by default; the Delete Agent API removes both.