> ## Documentation Index
> Fetch the complete documentation index at: https://www.ito.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets & Variables

> Provide your repository's environment variables, encrypted secrets, and test data to ensure accurate testing by Ito.

While Ito can often run your environment without any additional configuration, you can ensure a high quality, consistent build of your environment by providing us with key services, secrets, and private packages that are required to run your code correctly.

<Warning>
  **Never provide production credentials or access to production systems.** Ito actively tests adversarial behaviors, so use dedicated test accounts and a staging or development environment where testing is safe.
</Warning>

### How Ito protects your secrets

As a company that previously worked in crypto, where a security flaw meant permanent loss of funds, Ito takes security very seriously.

To protect your data, Ito encrypts secret values in your browser before storing them. Ito's application servers and database cannot decrypt them. We also take the following measures:

* Secrets are encrypted with RSA-OAEP (SHA-256) using a 4096-bit public key. The matching private key exists only in a dedicated, isolated decryption service. It is never present on Ito's API servers, in its database, or in its logs.
* Secret values are write-only. After you save a secret, Ito can show its name but cannot return its plaintext value through the UI or API.
* For a test run, Ito stages the encrypted value and the isolated runner requests decryption with a single-use, short-lived signed job ticket. Plaintext exists only briefly in the runner and in the test container's environment. The runner is destroyed when the run ends, and secret values never enter build caches.
* Before Ito uploads test artifacts or logs, it redacts secret values and token-shaped strings. A separate verification step blocks the upload if it detects a secret value. If Ito cannot verify that an upload is clean, it does not leave the runner.
* Ito audit-logs secret creation, updates, deletion, listing, and value access. Audit logs record secret names, never secret values.

If you have questions about our security practices, you can contact us at support \[at] ito.ai.

## 3 Types of Data You can Provide

Ito supports three types of per-repository context that are injected into the test environment when running AI code review and validation on your pull requests.

| Type          | Description                    | Example use case                      |
| ------------- | ------------------------------ | ------------------------------------- |
| **Variables** | Plain environment variables    | Base URL, feature flags               |
| **Secrets**   | Encrypted credentials          | API keys, passwords                   |
| **Seed data** | Test data not in your codebase | Test user credentials, sample records |

## Variables

Variables are plain-text environment variables made available to the test environment. Use them for non-sensitive configuration your tests need.

Navigate to **Settings → Context & Secrets**. Choose the repository you want to configure from the dropdown. Click **Add Variable**, enter a name (e.g. `BASE_URL`) and value, then save.

Variable names are automatically uppercased. Use `SNAKE_CASE` naming for consistency.

## Secrets

Secrets work like variables, but are encrypted before being stored. Your secret values are encrypted in your browser before they are sent. Ito never receives the plain-text value.

Navigate to **Settings → Context & Secrets** and select a repository. Ito automatically fetches the current public key used to encrypt secrets. Click **Add Secret**, enter a name (e.g. `STRIPE_SECRET_KEY`) and value. The value is encrypted locally before being saved.

Secret values cannot be retrieved after saving. Only their names are visible. If you need to change a value, update the secret.

## Seed Data

Seed data lets you provide structured test data that the AI agent can use during testing, such as test user accounts or sample records that don't exist in your repository's codebase.

Each seed data item has a **name**, a **value**, and an optional **description** explaining its purpose.

Navigate to **Settings → Context & Secrets** and select a repository. Click **Add Seed Data**, fill in the name, value, and description, then save.

Use seed data for test credentials (e.g., a staging account username and password) so the AI agent can log in and test authenticated flows.

Never use production credentials as seed data. Always use dedicated test accounts on a staging or development environment.

## Managing existing items

You can edit or delete any variable, secret, or seed data item from the [**Context & Secrets** settings page](https://app.ito.ai/settings/context-secrets). Changes take effect on the next test run triggered against that repository.