Secrets
How NOME Build Cloud isolates secrets per project, keeps them out of receipts, and scopes them to the host that needs them.
Per-project isolation
Secrets are isolated per project. One project's secrets are never visible to another project or another tenant. Secrets are injected into a job only when that job needs them and only on the runner that runs the job.
Never in receipts or logs
Receipts and logs never contain raw secrets. Output is scanned for secret-shaped lines — API keys, bearer tokens, private keys — and those lines are scrubbed before anything is recorded. A receipt records that a secret was used, never the secret itself.
Host-scoped on owner-edge
On an owner-edge runner you can keep secrets in your own environment or secret store; NOME does not slurp dotfiles or scrape environment variables for credentials. Connector tokens (GitHub, GitLab) are stored encrypted in the connector vault and resolved at dispatch, never logged.
Rotation and revocation
Secrets and connector tokens can be rotated or revoked. Revoking a runner invalidates its device token immediately; rotating a connector token cuts off post-back until you reconnect. NOME fails closed when a required secret is missing rather than proceeding without it.
Ready to try it?
Open NOME