密钥进保险库别进模型
Vault keys never hit the model
要点
- 凭证进保险库，需要时走专用通道，明文永远不进模型上下文
- Bot 只发建 Linear issue 这类意图，宿主再注入真正的 API key
- 密钥只出现在最终构造 HTTP 请求的宿主侧，模型看不到 token
- 别再给 agent 手搓 env 文件，这是降低密钥泄露的默认路径
原帖开头
this card allows grok bot to store credentials securely in a vault! when the credential is needed, it goes through a special access path where its never exposed to the model in plain text later when you say "file a bug that login is broken", the bot turns that into a linear call …
