Skip to content
Palladin.ioDocumentation
PL
Docs/Security whitepaper

Using a secret

Get, Exec, and Inject have different disclosure boundaries.

1.025.10.2026Markdown ↗PDF ↓Read in full ↗

Get: deliberate disclosure

The runtime decrypts approved data and returns it to the caller. If the caller is a model, plaintext enters its context. This path must not be described as hiding secrets from AI.

  1. Ciphertext
  2. Runtime: decrypt
  3. Caller / model: plaintext
Get discloses permitted data to its recipient.

Exec: use in a process

The runtime supplies required fields through the target process environment, not command arguments. The standard model response is limited to status; child output is withheld. The target process nevertheless receives the secret and must be trusted for the task.

  1. Model: program + arguments
  2. Runtime: local decryption
  3. Process: credential in env
  4. Model: status
Exec separates the model from data supplied to the process. The process remains inside the trust boundary.

For Script entries, returning the script result to the agent is a separate option. The result may disclose data, including encoded or transformed values. Enable it only for a trusted script and a deliberately selected result.

Inject: use in a browser

The local Palladin program sends the secret to the browser integration over a protected connection. Before filling the form, it checks the HTTPS address, tab, current page, and selected entry. The model receives the operation result without field values.

  1. Runtime
  2. Authenticated channel
  3. Verified HTTPS form
  4. Destination site: plaintext
After filling, scripts on the destination site may read the values.

Inject requires a compatible browser integration and an authenticated channel to the runtime. An extension ID alone does not prove store provenance. An unavailable provider ends the operation; it never automatically enables Get.

Data lifetime

The runtime limits plaintext lifetime and copies. It does not cache delivered credentials between calls. This does not protect against privileged memory inspection. Unix Script execution has a controlled exception: a private temporary source file removed during cleanup. Details depend on the platform and artifact.