Unverified50% confidenceFactExact time
DevBox's sandbox contains only dummy secrets, and outbound traffic passes through a proxy layer called iron-proxy, which replaces the dummy secrets with real ones.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/31/2026
First Seen
Valid until: 1/29/2027
Sources
Related Entities
Related Claims
UnverifiedThe OpenAI key is stored as a secret on the Docker side; the key is temporarily attached only when the sandbox makes a request, and the key itself never resides inside the sandbox.74% similarUnverifiedIn the credential injection mechanism, the container in the sandbox receives fake keys, which are only replaced with real credentials at the outbound proxy layer.71% similarUnverifiedAPI keys use secure key injection: when a network request leaves the sandbox, a proxy outside the container intercepts it and injects the credentials, so the AI container never knows the real token.70% similarUnverifiedVendor keys are encrypted at rest using a Fernet master key; the master key is generated at first startup, persisted to a Docker volume, and never leaves the container.69% similarUnverifiedAgentCore Gateway stores backend secrets in AWS Secrets Manager, where the gateway injects them on an internal path and strips them before the response is returned, so that the model context never contains secrets.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1121080API
curl https://kongchang.com/api/v1/knowledge/claims/1121080MCP
get_claim(id=1121080)