How secrets and operational access work
Understand secret boundaries, runtime injection, rotation and support access.
Last updated 2026-09-02
What you'll achieve
- Keep secrets out of source
- Rotate credentials safely
- Recognise safe support requests
Secret lifecycle
Secret values are accepted through protected input paths, encrypted for storage and referenced by project and environment. The dashboard and CLI return metadata rather than reading a stored value back. Rotation creates new evidence without placing the value in source, command arguments or logs.
Runtime boundary
Only an authorised workload with the declared binding receives a secret at execution time. Browser code, repository exports, plugins and support bundles do not receive platform credentials. Customers remain responsible for limiting third-party credentials and rotating them after suspected exposure.
Support and audit
BlinkHost uses least-privilege service identities and audited operational procedures. Support should never ask a customer to paste a secret into email, feedback or chat. Report the secret name and request identifier instead of its value.
Help improve this page
Sign in to send page-specific feedback. For account-specific help, email support@blinkhost.me.