2 min lesson

When staging evidence should not be public

Replace one public staging artifact, then confirm its audience and retention.

The checkout video shows the staging account email, and GitHub artifact posting exposes it through an unauthenticated URL.

Private run evidence or public PR embed

Secret: Reviewed in the run: The staging password is a Runtime Secret on the staging environment, so its value is redacted from model-visible output, the transcript and commits. · Public by mistake: Saving a sensitive password as an ordinary Environment Variable or pasting it into the prompt, then assuming its value is hidden from the agent.

diagram: compare

Pick a row to see what to look for.

When staging evidence should not be public

Step 1 of 3