> ## Documentation Index > Fetch the complete documentation index at: https://e2e.tester.army/docs/llms.txt > Use this file to discover all available pages before exploring further. # Security > What the model can see and do, how secrets stay out of it, and what you still need to watch. e2e trusts the code you write and treats everything the app shows as untrusted. App content can't grant the model tools, credentials, or a larger budget. ## How secrets stay out of the model A `Secret` is a handle with no plaintext accessor. The model sees only its name and purpose. When the model asks to fill one, the runner checks the field and types the value itself. Every known secret value becomes `` in the model's text input, reports, console output, and `.txt`, `.csv`, `.json`, `.html`, and `.htm` downloads. ## What can still leak Redaction matches strings, and screenshots mask secure fields only: - **Screenshots, the model's included.** A generic secret filled into a plain input, or a value the app shows outside a secure field, is in the image and reaches your model provider. Use test credentials, not production secrets. - **Video and downloads.** Video masks nothing, and a download other than a redacted text file is kept as served. If the test typed a password, check them before you share them. - **`command.log`.** It holds your app's stdout and stderr verbatim. Keep secrets out of your app's output. - **Transformed values.** The last four characters of a key, or its base64, pass through. Assert the outcome, not the secret. - **Values not filled as a secret.** Only a configured secret's value is redacted. A value a sign-in sets in a cookie is not. - **Request credentials.** `basicAuth` answers a `401` from any origin. `headers` reach every host under a shared domain such as `vercel.app`. - **Committed recordings.** Cache entries store typed values verbatim, except secret fills. They aren't signed and replay with your permissions, so review them as you would test code. [Where redaction stops](https://e2e.tester.army/docs/reference/security#where-redaction-stops) lists every case. ## What the model sees and does The model sees your instruction, the screen as an accessibility tree, the redacted URL, and records of earlier steps in the test. It gets a masked screenshot when it asks for one or a step sets `vision`. The model acts only through tools. The runner checks each call against a closed schema before it runs, and never evaluates model text as code. A call that breaks a rule, such as a navigation to `file:`, fails with `POLICY_DENIED`. There is no origin allowlist: the agent can follow the app to another site and use the step's secrets there. ## What runs with your permissions Your tests, config, engines, tools, reporters, stores, secret providers, and app commands run with your operating-system permissions, unsandboxed. Run untrusted pull request code in an external sandbox with no secrets or write tokens. ## What leaves your computer A run connects to your model provider, the app under test, and, unless you opt out, [telemetry](https://e2e.tester.army/docs/telemetry) at `eu.i.posthog.com`. There is no crash reporting. A CLI command on a terminal checks `registry.npmjs.org` for a newer release at most once a day, `e2e feedback` checks before each report unless `--allow-outdated`, and `e2e upgrade` reads the versions of the e2e packages the project lists. Integrations such as Kernel, Expo Simulators, Limrun, and smol add their own destinations, listed with the rest under [Outbound connections](https://e2e.tester.army/docs/reference/security#outbound-connections). ## Report a vulnerability Report privately through [GitHub security advisories](https://github.com/tester-army/e2e/security/advisories/new) or by mail to security@e2e.com. The [security policy](https://github.com/tester-army/e2e/blob/main/SECURITY.md) states response times and supported versions. ## Next Every rule behind this page, as the code enforces it. Pass secrets to tests and agent steps, and save sessions. Give model keys only to builds you trust.