Isolated by default
Every agent session runs in its own cloud computer, not on your laptop or a shared runner.
Security
Uno gives every agent session a disposable cloud computer, a constrained set of tools, and credentials it can use but never read. Teams get the speed of autonomous coding with a blast radius they can reason about.
Every agent session runs in its own cloud computer, not on your laptop or a shared runner.
Agents use placeholders. Real credential values are substituted outside the machine.
Work lands on a branch and a pull request, where your existing review and CI still apply.
Architecture
An autonomous agent is only as safe as what it can think with, run on, and reach. Uno draws a boundary around all three instead of trusting the model to behave.
Model calls run in Uno's control plane against the repositories, skills, and policies a workspace has connected. A session is given the context its task needs, not a standing view of everything your team owns.
Commands, builds, tests, and browsers execute inside a per-session cloud computer. Nothing runs on a developer machine, and a hostile dependency or prompt injection is contained to an environment that gets thrown away.
Agents reach Git, GitHub, and connected MCP tools through Uno's toolbox, against the repositories and integrations the workspace authorized. An agent cannot widen its own scope.
Isolation
Running agents directly on laptops or shared CI runners means one bad command, package, or injected instruction reaches everything that machine can touch. Uno moves the work into an environment that is created for the task and deleted after it.
01
Each agent session gets its own cloud computer with its own filesystem, processes, ports, and network identity.
02
The sandbox receives the repositories, tools, and credentials that session was authorized to use, and nothing else.
03
Commands, tool calls, file changes, and previews stay visible to the team in the session timeline.
04
Environments are disposable. Changes leave as a branch and pull request; the machine does not stay behind.
Secrets
The usual way to give an agent an API key is to export it into the environment and hope. Uno does not put the value in the environment at all. The sandbox holds an opaque placeholder, and the real credential is swapped in outside the machine, on the way to the host you allowed.
In the sandbox
Authorization:
Bearer <uno-secret>The agent reads, logs, and passes around a placeholder. There is no value to steal.
On the way out
host allowed ->
substitute real valueSubstitution happens outside the sandbox, only for the hosts that secret is scoped to.
Everywhere else
host not allowed ->
no substitutionAn exfiltration attempt sends a meaningless string to whoever is listening.
Sensitive workspace and repository values are resolved in Uno's control plane and registered with the secret service. The environment the agent works in only receives a placeholder.
When the agent calls an API, the placeholder in the HTTPS request header is replaced with the real value outside the machine. The credential is usable without ever being readable.
Every secret can carry an allowed-host list. Point a token at an unexpected domain and the substitution simply does not happen.
Bindings are scoped to a secret version, a session, a sandbox, and a grant window, then cleaned up once that window closes.
Rotating, re-scoping, or revoking a secret detaches every binding and restarts the affected environments, so old process state cannot keep using it.
Known secret values are redacted from command results, tool responses, and stored artifacts, so a credential does not leak into a log you later share.
Controls
Teams ship faster with agents when granting access is cheap and taking it back is cheaper. These are the controls that make that trade reasonable.
Repositories, members, connected tools, skills, and policies belong to a workspace. A session inherits that scope and cannot reach past it.
Agents ask for the values and integrations a task needs. A human decides what to attach, to which hosts, and for how long.
Work arrives on a branch as a pull request, where your reviewers, branch protection, and CI checks apply exactly as they do for humans.
Commands, tool calls, file changes, and outputs are captured in the session timeline, so a review can trace what happened and when.
Destructive or outward-facing actions stop for a human decision instead of being taken on the agent's initiative.
Remove a repository, a tool, a member, or a secret and the change propagates to running environments rather than waiting for the next deploy.
Limits
Security pages usually stop at the good news. These are the boundaries we would want to know about if we were the ones reviewing Uno.
Credentials are substituted into HTTPS request headers. Values placed in query strings, request bodies, or re-encoded by hand are outside that path, so integrations should authenticate with headers.
Hiding the value and restricting hosts defeats accidental leakage and opportunistic exfiltration. It is not a guarantee against code you deliberately choose to run. Grant narrow, short-lived credentials anyway.
Agents read issues, pages, and dependencies that anyone can write. We assume some of it is hostile, which is why the sandbox is disposable, the tool scope is fixed, and merging stays a human decision.
If your review needs our current posture, subprocessors, or data handling details in writing, ask and we will answer specifically rather than pointing at a badge.
Responsible disclosure
Email contact@uno.engineering with the affected area, the steps to reproduce it, and what you were able to reach. We will confirm receipt, keep you updated while we fix it, and credit you if you want the credit. Please do not run tests against other people's workspaces or data.
Reviewing Uno for your team? Use the same address for security questionnaires, data handling questions, and architecture deep dives.