Mission #19: Your pipeline should not know your keys
Where does your OpenAI key live right now? In your .env. In a teammate's .env. In the CI settings. In the container image. On that one laptop nobody has updated since March. Every one of those is a copy, and any copy can leak.
On RocketRide Cloud, you stop carrying the key. An org admin stores the secrets on the server, at the org, team or user level. When a pipeline starts, the server fills in the values. So a pipeline can run with no local secrets at all. No provider key in CI. Nothing to rotate on a laptop. Nothing inside the file you deployed.
There is one more rule, and it is a good one. The server only fills in RocketRide environment variables. If a pipeline file asks for any other variable, it gets <REDACTED> instead of the real value. So nobody can use a pipeline file to pull other secrets off the server, by accident or on purpose.
The safest secret is the one your pipeline never had a copy of.
How the levels work
Three levels: org, team and user. The server merges them, and the most specific one wins, so a user value beats a team value, and a team value beats an org value. A pipeline only ever sees the merged result. Deployed and scheduled runs use the server's secrets only. A run you start from your own workspace also sends the RocketRide environment variables from your .env, and they join the same merged set.
Four rules. Only RocketRide environment variables are filled in; anything else becomes <REDACTED>. A variable with no value anywhere stays as written, so check your config before you blame the provider. Values come from the merged set: your workspace .env plus the org, team and user secrets on the server. And project_id never takes a variable, because tools read it straight from the file, before any values are filled in.
Subscribe to Builder Plan now and get double the tokens in your first month: 5,000 instead of 2,500 on the $50 plan.
SF Tech Week starts Monday, and we are hosting three nights. The first one is the big one.
- Builders x Bosses x Beers, Monday 5 October, 6:00 to 9:00 PM Pacific, on the rooftop at Club 345, 345 California Street. No lanyards, no panels, no pitch decks. 100 pro developers, AI founders and technical leaders who are past the prototype and into the hard parts: reliability, observability, cost, trust. Doors, drinks and sunset at 6, short talks at 7 from teams actually shipping, bites and networking from 7:45. New for Monday: the AI Barmen, an AI-powered menu with voice ordering and cocktails mixed by a robot. Hosted by RocketRide with Monaco, Hotdata, Cushman & Wakefield and friends. Invite-only, 100 spots. Request access on the event page.
- Zero to Agent: Build with Primary AI, Tuesday 6 October, 6:30 to 8:30 PM Pacific at Cloudflare, 101 Townsend Street. An evening build session with Primary AI, including a RocketRide demo. Register on Luma.
- SF Founders X Product Showcase, Friday 9 October, 5:30 to 8:30 PM Pacific in San Francisco. A private demo night: founders get a few minutes on stage with a live product, no slides and no sales pitches. RSVP on Partiful. Want a slot? Email shashidhar.babu@rocketride.ai with your company name, a short description and what you will show.
Last week, for the record: a booth in the tech expo at WeAreDevelopers World Congress North America in San Jose, shared with LaserData, with Co-founder Joe Maionchi and Chief Architect Rod Christensen on the floor, and SF Enterprise Hackathon 2.0 in Mountain View, which closed with more than 250 registered. The calendar is where everything else lands first.
Our newest post, by Mansi More, takes a swing at our own category, which is not the usual direction. It starts from a definition worth stealing: A harness runs your agent. A meta-harness runs harnesses and lets you swap every piece, including the agent framework. Most people building agents have already written a harness. They just never called it that.
Then it argues against itself. The second layer only earns its complexity when you are running several agents across several frameworks, and if you are not, it is a layer you will maintain and not use. The line that lands hardest is about what happens when you refuse the separation: "Bolt them into one program and every fast-moving part drags the slow ones along with it."
It is also unusually straight about what RocketRide is built around: the pipeline, with the agent as one node next to document processing, retrieval and everything else in the data path, rather than the agent loop itself. The reasoning, and the three questions it says to ask before you add the second layer, are in the post.
Member discussion