Zero Secret Leakage:

• Tokens, cookies, and secret keys are never echoed to standard output, error dumps, or logs.
• Credentials passed via flags are sanitized in process memory.

At-Rest Encryption:

• Stored credentials at ~/.config/rsh/config.json are encrypted using AES-256-GCM.
• The encryption key is derived dynamically using scrypt with a machine-bound signature and salt.
• Permissions on config files are enforced to 0600 (read/write only by file owner).

In-Transit Protection:

• All network traffic to https://replit.com/graphql uses TLS 1.3.
• All container WebSocket connections use WSS (wss://eval.repl.it/wsv2/...) with strict certificate validation.

Container Sandboxing & Isolation:

• Remote shell sessions execute within isolated Linux MicroVMs managed by Replit Container Manager (conman).
• Process privileges follow standard non-root runner container restrictions.