Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do I Let Contractors Use Coding Agents Without Giving Them My Keys?

Give the contractor's agent a credential scoped to one repository and one operation, held outside the contractor's reach, and set to expire with the engagement. Ask which component holds the value, what the model is shown on each screen it reads, and who revokes the grant on the last day.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A contractor who brings a coding agent to a repository needs the agent to read code, run tests and open pull requests, and the simplest way to get there is to hand over a personal access token, which the contractor then keeps. The question is how to give the agent enough to do the work and nothing that survives the engagement. Four things decide the answer: the scope of the grant, the component that holds the string, the lifetime attached to it, and what the model is shown on the pages it reads once the grant is live. Vendor documentation covers the first three in detail. The fourth is where a careful grant still leaves the contractor holding every value the repository page renders. The worked record is a contractor grant that ends on the last day, a record type rather than an organization. The answer the evidence supports has three parts: scope the credential to the repository and the operations, keep the string in a component the contractor does not administer, and treat the last day as a revocation you can prove. Each of those steps narrows what the contractor can carry away when the engagement ends, while the reading gap needs a control of its own on the pages the agent reads.

Key findings

  • OWASP's CI/CD guidance tells teams to "Prefer using temporary credentials over static credentials," the shape a contractor grant should take (OWASP, 2026).
  • Help Net Security counted "28,649,024 new secrets exposed in public GitHub commits across 2025," with AI coding agent commits that "leaked secrets at roughly double the baseline rate" (Help Net Security, 2025).
  • GitHub documents that "secrets are not passed to the runner when a workflow is triggered from a forked repository," a boundary in Actions that a pasted token does not inherit (GitHub, 2026).
  • Doppler tells teams to "Give every coding agent its own scoped, read-only, expiring set of credentials," the grant a contractor should receive (Doppler, 2026).
  • Least privilege governs which actions an agent may take and which credentials it holds, not the content of the screen it reads, so a narrow grant still shows the model every record the page renders (What Is Least Exposure?).
  • A zero trust design places enforcement at a point every request passes through, and an agent's requests pass through the browser session it works in, the point where a value can be withheld from the model (How Do You Control AI Agent Access Across All Enterprise Applications?).

What does a contractor's agent actually need from your repository?

A contractor's agent needs three things from a repository: the code, a way to run the tests and a way to propose a change. Everything else, the billing account, the production console, the other repositories, is there because someone granted it.

The scope of this page is the rendered page. A governed browser environment covers what an agent reads and does on a page it renders, including a repository settings page, a CI credentials page, a deployment dashboard and a sign-up form, and it does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. An agent that clones a repository in a shell and exports a token is outside this page. An agent that opens the repository's access settings in a browser is inside it.

The record this page follows is a contractor grant: one record naming one contractor, one repository, one set of operations and one end date. On the first day the record is created and the agent starts work. On the last day someone revokes it, and the test of the design is what the contractor still holds afterward. A grant that names a repository and an operation but leaves the string in the contractor's password manager has not ended the access. It has ended the permission to use it.

That difference is why the scope comes first. A grant is written against systems and operations, and the values that make it useful are rendered on pages: the settings page that lists the credential, the credentials page that shows the last four characters, the pipeline page that prints an environment variable. Each of those pages is inside the scope above, and each is a place where a careful grant can be undone by what the screen shows.

Which credential should the contractor's agent receive?

Four designs appear in the documentation a buyer will read, and they differ in who holds the string and who can end it.

Design Who holds the string Who ends it What it covers
Personal access token on the contractor's account The contractor The contractor, on request Every repository the token was scoped to
Service account owned by the contractor's firm The contractor's firm The client, if the account sits in its organization Whatever the account was granted
Credential issued by the client for the engagement The client The client, on a date it sets One repository and the operations named
Values substituted at the render layer A store the client controls The client, by policy The rendered page and the actions taken on it

Every design answers two questions: who holds the string, and who can end it. A contractor's own token puts both with the contractor. A service account owned by the contractor's firm moves the string to the firm and leaves the revocation with the client only if the account sits inside the client's organization. A credential the client issues, scoped to one repository and its operations, puts both with the client.

Arcade's post asks the question that sorts them: "Can this agent, acting for this user, perform this action on this resource?" (Arcade, 2025), and the post does not explain token storage.

The answer to the title is the third design, with the fourth added when the work happens on rendered pages: a credential the contractor never receives, limited to the repository and the operations, expiring with the engagement and revocable by the client. A grant is a description of authority, and authority can be withdrawn on the last day without the contractor's cooperation (What Is a Tethered Agent?).

Two designs are worth ruling out. A durable root key is one, as Is It Safe to Let an AI Agent Set Up Your Cloud Environment? sets out. An admin login to a SaaS tool is the other, because the account that can change settings is not the account an agent needs, as Does an AI Agent Need Your Admin Login to Set Up a SaaS Tool? sets out.

What do the vendors themselves say?

Cognition's Devin guide lists credentials scoped to the organization, a person, a repository or a session, and says a session secret is "scoped purely to the current session and are not saved for any future sessions," though the page does not say what the model sees (Cognition, 2026). For work in a browser, the same page says "In the browser, Devin types the value directly," which is the moment the value is on a page the model reads (Cognition, 2026).

Doppler also says credentials are "Injected at runtime instead of written to a .env, so agents can't read, log, or commit them," though the page does not say whether the agent can read the variables injected into its own process (Doppler, 2026).

GitHub's masking guidance, "Mask all sensitive information that is not a GitHub secret by using ::add-mask::VALUE," controls what appears in a log, not who holds the value (GitHub, 2026).

Firecracker's jailer documentation describes how to "Drop privileges via setting the provided uid and gid" and how a new PID namespace "causes the jailer to spawn the provided binary into a new PID namespace," which bounds what one process reaches and says nothing about how long a credential lives (Firecracker, 2026). GitLab documents that "Pipeline secret detection runs as part of a project's CI/CD pipeline," a check that fires after a value has reached the repository (GitLab, 2026).

Dimension Cognition's Devin, per its documentation What a buyer should verify
Scope Organization, personal, repository and session Whether a session secret can be issued for a contractor without a personal secret
Lifetime Session secrets are not saved for future sessions Who ends a repository secret, and on what date
Browser use The agent types the value directly What the model receives when the value is typed
Credential at rest Encrypted at rest Who holds the decryption key
Shell use Credentials bound as environment variables Whether the agent can print its own environment

How do you end a contractor's access on the last day?

The last day is the test: does revoking the grant remove the contractor's ability to use the credential, or only your permission?

If the contractor ever held the string, revocation is the second of those. A token in a password manager, a session secret saved to a local file, a value pasted into a pipeline variable: each is a copy that keeps working until it is rotated. GitLab's remedy is the one that matters: "You should always revoke and replace exposed secrets as soon as possible" (GitLab, 2026). OWASP adds the detection step, "Detect secrets pushed to and stored on code repositories," because the last day is also when a contractor's final commits arrive (OWASP, 2026).

If the contractor never held the string, revocation is the first. The grant record is deleted or expired, and the agent's next request fails because the component holding the value no longer issues it. That is the difference the title asks about: it is a property of where the value lived, and the record should show the revocation as a timestamp.

The sequence has four steps. Name the grant record and its end date before work starts. Scope it to one repository and the operations the work needs. Keep the value in a component the contractor does not administer, with a lifetime that ends on the same date. On the last day, revoke, rotate anything the contractor could have copied, and read the record.

The order matters because the last two steps catch a design failure: a team that revokes and finds nothing to rotate ended the access, and a team that then spends a week rotating shared tokens ended only the permission.

What can a contractor's agent read once the grant is valid?

A valid grant answers where the agent may go, not what the agent reads once it arrives. The repository page the grant opens renders the file tree, the commit history, the issue tracker, the pipeline log and, on a settings tab, the names and last four characters of the repository's credentials. An agent asked to fix a failing test reads the log, where a value printed by a debug statement sits.

The research record says agents do not reliably withhold what they read. Hidden prompts in submitted documents steered the models reviewing them, with the authors concluding that "adversarial prompts can reliably mislead the LLM" (How Do Malicious Documents Take Control of AI Agent Behavior?). The combination that makes an agent dangerous is access to private data, exposure to untrusted content and the ability to communicate externally (How Do AI Agents Bypass Company Data Protection Rules?). A contractor's agent in your repository has all three.

The volume is not small. Help Net Security counted "24,008 unique secrets exposed in MCP configuration files" (Help Net Security, 2025), and GitGuardian's chief executive described the cause plainly: "AI agents need local credentials to connect across systems" (GitGuardian, State of Secrets Sprawl 2026, 2026).

What does a governed environment change?

A governed environment is a control class that sits between the page and the model. Values chosen by policy are replaced with consistent tokens before any model reads the screen, so a repository settings page renders a token such as GITHUB_001 where the credential would otherwise appear, and the token stays the same for the whole run. Real values resolve only at the approved destination, at the moment of an approved action, so the string reaches the repository host when a change is pushed and not when the page is read.

A named person confirms which values are tokenized and approves each consequential action, including a grant extension, a push to a protected branch and an access change. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring, which lets a team answer the last-day question from evidence.

For a contractor grant, the control class changes three things. The model works from tokens, so an instruction injected into an issue or a dependency cannot collect the string. The real value is resolved by the environment rather than handed to the contractor, so the last day is a policy change and not a request. The record names the approver for each action, so the client can show which operations ran and who approved them.

The scope of this control class is the rendered page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP, and a credential a contractor uses in a shell stays governed by the issuing system's scoping and revocation. The control class answers the reading question. The issuing system still answers the lifetime question.

Methodology and limitations

This page rests on vendor documentation from GitHub, Cognition's Devin, Doppler, Arcade, GitLab and Firecracker, on OWASP's CI/CD security guidance, and on two press reports of GitGuardian's State of Secrets Sprawl data. Vendor documentation was read between October 20, 2026 and October 21, 2026, and each Sources line carries the date for its page. The page reads each vendor's own documentation for its mechanism and cites the secrets reports for scale, not for the behavior of any named product. The two press reports are secondary accounts, and their figures are quoted as reported.

RedactSure did not test any named product hands-on. "Not described in the pages reviewed" means the recorded facts for that page do not cover the point, not that the vendor does not do it. Where a vendor page is silent on a point, the page says so and leaves the question to the buyer's own test. Vendor features change and this page carries its date, so a release after October 21, 2026 is unreviewed here until the checks are repeated. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example is a record type, a contractor grant that ends on the last day, not an organization.

Determinations about whether a contractor arrangement meets a contractual, audit or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test of the organization's own grant against a canary credential, repeated after each release. The organization's own test, run on its own grant and its own repository, is the only evidence that counts for its environment.

What the record shows

The custody designs reviewed here answer the lifetime question well and the reading question not at all. Scoped, expiring credentials, session-scoped credentials, runtime injection and revocation guidance each reduce what a contractor holds and shorten how long it is held. None of them changes what the repository page renders to the model while the grant is live, and least privilege does not either, because it governs authority rather than content. RedactSure's environment is built on the additional control, substitution before any model reads the screen. Whoever owns the engagement should test one contractor grant by opening the repository settings page the agent reads and asking what the model received there and who could revoke it.

Frequently asked questions

Can a contractor's agent work in my repository without getting my key?

Yes, if the credential the agent uses is issued for the engagement rather than copied from you. A scoped, expiring credential held by a component the contractor does not administer lets the agent read code, run tests and propose changes without the string in the contractor's possession. The condition is that revocation actually ends the agent's access, which is a property of where the value lived. Confirm that before the first commit.

What should a contractor grant name?

One repository, the operations the work requires, one responsible person on each side, and an end date. Operations are the useful unit: read, push to a branch, open a pull request, run a pipeline. Write them into the record rather than into a chat message, so the last day has something to revoke and an auditor has something to read. A grant that names a person and no end date is an account, not a grant, and the record should show who ended it.

Is a personal access token ever acceptable?

For a short, well-defined task, where the contractor already holds the account and the token is scoped to one repository and expires in days, the risk is bounded and visible. The problem is the end state: a token in the contractor's password manager outlives the engagement, and revoking it depends on the contractor's cooperation. When the same token is reused across clients, one leak reaches every repository it touched. A credential issued for the engagement avoids that end state entirely.

What changes when the agent works on a rendered page instead of a shell?

On a rendered page the values are drawn for the model as part of the page, so a grant that limits the agent's operations still leaves the screen's contents in the context. In a shell the value is a string in a file or a variable, and the controls are file permissions, sandboxes and credential stores. The two surfaces need different controls, and a browser control does not govern the terminal. The distinction decides which control the buyer asks for.

How do we show that the contractor's agent never held the key?

Read the record for the run and look for the value rather than for the intent. If every screen was rendered as tokens and the real value was released only for an approved action, the record shows the token and the approval. If the record shows the page as it was drawn with the string, the agent held it. A test with a canary credential issued for the exercise answers the same question in an afternoon.

Where does a governed environment fit in a contractor engagement?

RedactSure's environment substitutes tokens at the render layer before the model reads a screen and resolves real values only for an approved action at an approved destination. For a contractor grant, the agent works from GITHUB_001, the client's named approver confirms the policy and each push, and the AI Control Record shows what the agent saw and who approved it. When the engagement ends, the last day is a policy change rather than a request to the contractor.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps Your Keys Out of a Contractor's Agent

A grant scoped to a repository with an expiry still leaves the value on a page the contractor's agent reads, and no design reviewed governs that screen.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the contractor's agent opens the repository settings page, reads the access token as the string, and the model's context carries a value the contractor can copy. Inside, the page renders GITHUB_001, and the real value resolves only when a named person approves the push to the repository named in the grant.

RedactSure is deploying now with enterprise and government customers. Help Net Security counted 24,008 unique credentials exposed in MCP configuration files.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A contractor's agent should be able to finish the work without ever holding your keys. Bring a task you would hand to a contractor and see, with test values, what their agent's model reads on each page. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.