Skip to main content
While Ito can often run your environment without any additional configuration, you can ensure a high quality, consistent build of your environment by providing us with key services, secrets, and private packages that are required to run your code correctly.
Never provide production credentials or access to production systems. Ito actively tests adversarial behaviors, so use dedicated test accounts and a staging or development environment where testing is safe.

​
How Ito protects your secrets

As a company that previously worked in crypto, where a security flaw meant permanent loss of funds, Ito takes security very seriously. To protect your data, Ito encrypts secret values in your browser before storing them. Ito’s application servers and database cannot decrypt them. We also take the following measures:
  • Secrets are encrypted with RSA-OAEP (SHA-256) using a 4096-bit public key. The matching private key exists only in a dedicated, isolated decryption service. It is never present on Ito’s API servers, in its database, or in its logs.
  • Secret values are write-only. After you save a secret, Ito can show its name but cannot return its plaintext value through the UI or API.
  • For a test run, Ito stages the encrypted value and the isolated runner requests decryption with a single-use, short-lived signed job ticket. Plaintext exists only briefly in the runner and in the test container’s environment. The runner is destroyed when the run ends, and secret values never enter build caches.
  • Before Ito uploads test artifacts or logs, it redacts secret values and token-shaped strings. A separate verification step blocks the upload if it detects a secret value. If Ito cannot verify that an upload is clean, it does not leave the runner.
  • Ito audit-logs secret creation, updates, deletion, listing, and value access. Audit logs record secret names, never secret values.
If you have questions about our security practices, you can contact us at support [at] ito.ai.

​
Three types of data you can provide

Ito supports three types of per-repository context when running AI code review and validation on your pull requests.

​
Variables

Variables are plain-text environment variables made available to the test environment. Use them for non-sensitive configuration your tests need. Navigate to Settings → Context & Secrets. Choose the repository you want to configure from the dropdown. Click Add Variable, enter a name (e.g. BASE_URL) and value, then save. Variable names are automatically uppercased. Use SNAKE_CASE naming for consistency.

​
Secrets

Secrets work like variables, but are encrypted before being stored. Your secret values are encrypted in your browser before they are sent. Ito never receives the plain-text value. Navigate to Settings → Context & Secrets and select a repository. Ito automatically fetches the current public key used to encrypt secrets. Click Add Secret, enter a name (e.g. STRIPE_SECRET_KEY) and value. The value is encrypted locally before being saved. Secret values cannot be retrieved after saving. Only their names are visible. If you need to change a value, update the secret.

​
Seed Data

Seed data lets you provide structured information that the AI agent can use while planning and running tests, such as test user accounts or sample records that do not exist in your repository’s codebase. Each seed data item has a name, a value, and an optional description explaining its purpose. Navigate to Settings → Context & Secrets and select a repository. Click Add Seed Data, fill in the name, value, and description, then save. Use seed data for test credentials (e.g., a staging account username and password) so the AI agent can log in and test authenticated flows. Never use production credentials as seed data. Always use dedicated test accounts on a staging or development environment.

​
Managing existing items

You can edit or delete any variable, secret, or seed data item from the Context & Secrets settings page. Changes take effect on the next test run triggered against that repository.