> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/understand/security-model.md). # What stays hidden, and what doesn't See which Devolutions CLI commands keep a secret out of sight, which ones hand the value over, and what Devolutions CLI can't protect you from. Every Devolutions CLI command that uses a secret has to put the value **somewhere**: in the environment of a program, in your terminal, in a file, in your shell, or in an AI model's context. Where it ends up decides who can see it. `devo secret run` keeps the value away from you, your shell, and your files. Other commands hand it over on purpose, because sometimes that's what you need. ## Where each command puts the value
WHEN YOU USETHE VALUE ENDS UPHIDDEN FROM YOU?
devo secret runIn the environment, or the standard input, of the one program you start. When it prints the value, you see <concealed by Devolutions> instead.Yes. Only the program receives it.
devo secret read
devo secret get		Printed in your terminal, or in the JSON or YAML output. With --out-file, written to a file instead.No.
devo secret injectWritten in plain text in the filled template, on the standard output or in the --out-file file.No.
devo secret shell enterIn environment variables of your current shell, and of every program you start from it, until you run devo secret shell leave. Nothing is masked.No.
devo secret setThe new value comes from an environment variable (--value-env) or a file (--value-file) that you prepare, never from the command line.Not from the command line or your shell history. The variable or file you prepared still holds it.
An AI client connected with devo mcpThe RDM_resolve_secret_reference tool returns the value to the AI client, which puts it in the model's context.No. The model, and its transcript, see the value.
SecretSpecDevolutions CLI returns the value to SecretSpec, which decides where it goes next.Depends on how you use SecretSpec. Devolutions CLI doesn't mask it.
{% hint style="warning" %} `devo mcp --read-only` doesn't keep values away from the model: `RDM_resolve_secret_reference` only reads, so it stays available. To keep secret values out of the model's context, add `--deny-tool RDM_resolve_secret_reference`. See [Limit what an agent can do](/cli/guides/ai-agents/limit-tools.md). {% endhint %} ## What this means for you **Prefer `devo secret run` whenever a program can read its secret from an environment variable.** The value goes to that program only, never to your shell, and it's gone when the program ends. See [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md). **References are refused in command arguments.** If you write a `devo://` reference after `--`, `devo secret run` stops and asks you to use `--env-ref`, `--stdin-reference`, or a launch manifest instead. **Files that hold a secret are private to you.** When `devo secret read`, `devo secret get`, or `devo secret inject` writes to `--out-file`, the file is readable and writable by your account only on macOS and Linux. On Windows, only your account, administrators, and the system account can open it. The value is still in plain text: delete the file when you're done. See [Fill a configuration file from a template](/cli/guides/secrets/fill-a-template.md). **Pick the command that matches how much you want to expose.** Reading a secret, filling a template, or loading it in your shell is sometimes the only option, for example for a tool that reads a configuration file. Just know that from then on, the value is in your terminal, your file, or your session. See [Use secrets in your current shell](/cli/guides/secrets/current-shell.md). ## How masking works, and its limits By default, `devo secret run` watches everything the program writes to its standard output and standard error, and replaces each resolved value with `` before it reaches your terminal or log. Masking is a safety net for what the program **prints**. It doesn't protect against what the program **does**: * Only the exact value is replaced. If the program prints part of it, encodes it (for example in Base64), or changes it, the result isn't masked. * A file the program writes, or a request it sends over the network, isn't masked. * The program's own child processes inherit its environment, so they receive the value too. * `--no-masking` turns masking off. Use it only when you need the exact output, never in a shared log. ## Who Devolutions CLI trusts Devolutions CLI trusts your operating-system user account. The background process runs under your account and talks to `devo` over a local channel on your computer. That channel accepts your account and, on Windows, the system account (see [Devolutions CLI on Windows, macOS, and Linux](/cli/guides/understand/platforms.md) for the exception). Every request, except a status check, must also carry a session token that Devolutions CLI keeps in your configuration folder. Your saved contexts are in your configuration folder, and your sign-in sessions are protected by your operating system's secure store. See [What data Devolutions CLI sends](/cli/guides/understand/privacy.md). This has a consequence: any other program running under your account is trusted the same way. It can run `devo` and ask for a secret, just as you can. ## What Devolutions CLI can't protect you from * **A program that receives a secret can leak it.** It can write the value to a file, send it over the network, or print it in a form masking doesn't catch. Only run programs you trust with your secrets. * **Other programs running as you.** Malware or an untrusted tool running under your account can use your contexts like you do. Devolutions CLI doesn't separate programs that run as the same user. * **Values you handed over.** Once you read a secret to your terminal, write it to a file, load it in your shell, or give it to an AI model, Devolutions CLI no longer controls where it goes. * **A compromised computer.** Like any tool, Devolutions CLI is only as safe as the computer and the user account it runs on. ## Next * [Run a command with its secrets](/cli/guides/secrets/run-with-secrets.md) * [Give an agent a credential without exposing it](/cli/guides/ai-agents/run-an-agent.md) * [Limit what an agent can do](/cli/guides/ai-agents/limit-tools.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/cli/guides/understand/security-model.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.