Why secret values are masked and never returned to the browser

In Environment, once you save a secret you'll only ever see a masked hint of it again — never the full value. This is a deliberate security design, not a limitation.

Masked by design

When the Environment list loads, the server returns only a masked hint for each variable — typically the last few characters, with the rest hidden. The full plaintext value is never sent back down to the browser after it's stored. The same principle applies to your account-level Bring Your Own Key vault and to Composio connection keys: only masked hints are surfaced, and the raw keys stay server-side.

Why it works this way

Secrets are encrypted at rest with AES-256-GCM under a project-scoped key, and the keys used to decrypt live only on the server. Decryption happens server-side, just-in-time, when the value is actually needed — it doesn't round-trip through your browser. Keeping plaintext off the client means a compromised browser session, a screenshot, or a copied page can't leak your secrets.

What this means in practice

• You can confirm which secret is set (by name and masked hint) but you can't read the full value back.
• If you lose the original value, re-enter it rather than expecting to retrieve it.
• This is operator-decryptable encryption with keys kept off the client — it is not zero-knowledge or end-to-end encryption, so don't treat it as a guarantee that no one server-side can ever decrypt.

Updating a secret

To change a value, just save a new value under the same name; it overwrites the encrypted entry.