Agents never hold your secrets.
Agents only ever see placeholders. The real value is substituted at Hezo's egress proxy, at request time, only for hosts you've allowed - so even a misbehaving agent has nothing to leak.
Four walls, by construction.
Security in Hezo isn't a setting - it's the architecture. Secrets, isolation, encryption, and audit are all on by default, for every agent, on every run.
The agent writes a placeholder.
Outbound requests leave the agent with __HEZO_SECRET__ where the credential should be. The egress proxy substitutes the real value at the last hop, and only for a host you have allowed - so there is nothing in the agent's hands to leak.
Every project runs in its own sandbox.
Each project gets a container of its own - agent runner, workspace, and tools inside; your machine outside. An agent that goes looking for your files finds a wall, not a path.
Encrypted at rest, with a key only you hold.
API tokens, chat history, and agent prompts are AES-256-GCM on disk. The master key that unlocks them is yours and is kept in memory - it is never written where Hezo could read it back.
Nothing in the trail is ever edited.
Every state change lands in an append-only activity log - a task closed, a hire approved, a request blocked, a release signed off - whether a person or an agent made it. Entries are added, never rewritten.
Git you can trust.
Each project gets its own Ed25519 key, and it signs every commit without ever entering the agent's container - so work lands on GitHub as Verified. Clone, fetch, and push run over HTTPS, with the credential swapped in at the egress proxy.
- Connect GitHub once via device flow; keys register automatically
- Every agent commit is signed and attributable
- All agent traffic - including git - routes through the egress proxy
Keep exploring
All features →Secure by default, in one command.
Open localhost:3100 - setup walks you through the rest.