{
  "slug": "hf-sandbox-exec-keeps-secret-values-out-of-argv-a713aa1e19be",
  "title": "hf sandbox exec keeps secret values out of argv",
  "tools": [
    "hf"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-17T10:21:24.000Z",
  "announced_at": "2026-09-17T10:21:24.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When passing secrets to a sandbox, use the name-only form to resolve values from the caller’s environment; however, v1.32.0 docs do not show a secrets option for `hf sandbox exec`. They document `--secrets` when creating a dedicated sandbox, then running commands with `hf sandbox exec`.",
    "examples": [
      "hf sandbox create -s <SECRET_NAME>",
      "hf sandbox exec <SANDBOX_ID> -- <COMMAND> [ARGS...]",
      "hf jobs run -s MY_SECRET python:3.12 python -c 'import os; print(os.environ[\"MY_SECRET\"])'"
    ],
    "gotchas": [
      "Version: v1.32.0",
      "SANDBOX_ID (required): Sandbox id printed by `hf sandbox create`.",
      "COMMAND... (required): Command to run in the sandbox.",
      "-s, --secrets SECRET: Set a secret environment variable; prefer a name to read its value from the environment. Documented for sandbox creation and Jobs run, not sandbox exec.",
      "--secrets-file TEXT: Read secret environment variables from a file; `-` reads stdin. Documented for sandbox creation and Jobs run, not sandbox exec.",
      "--pool: For pooled sandboxes, secrets are unavailable; use `--env` instead.",
      "Prerequisite: The name-only secret form reads the value from the caller’s environment. An unset requested secret is an error.",
      "Prerequisite: An env or secrets file should be readable only by you (`chmod 600`); the CLI warns if it is not.",
      "Prerequisite: Pooled sandboxes have no encrypted secrets channel; the CLI directs users to pass values with `--env` or `--env-file`.",
      "The name-only form reads the value from the calling environment.",
      "A secrets file should be readable only by you (`chmod 600`); the CLI warns if it is not.",
      "The `-s MY_SECRET=psswrd` form remains supported, but the value appears in shell history and the process listing and the CLI warns.",
      "The source says pooled sandboxes do not support the secrets channel; use `--env` for pooled sandboxes.",
      "Docs conflict: The release note names `hf sandbox exec --secrets`, but the v1.32.0 CLI source defines `hf sandbox exec` with `--env`/`--env-file` and no `--secrets`/`--secrets-file`; those secret options are on sandbox creation. The documented name-only secret example is `hf jobs run`. The exact task command `hf sandbox exec --secrets` is therefore not documented; see not_found."
    ]
  },
  "why_it_matters": "Pass a secret to a sandbox command without placing its value in the process argument list.",
  "before": "The CLI accepted secret values as flag arguments, including `--secrets KEY=value`, which placed them in `argv`; shell history and Linux `/proc/<pid>/cmdline` could expose them.",
  "sources": [
    "https://github.com/huggingface/huggingface_hub/releases/tag/v1.32.0",
    "https://github.com/huggingface/huggingface_hub/pull/4835",
    "https://github.com/huggingface/huggingface_hub/blob/v1.32.0/docs/source/en/guides/cli.md",
    "https://github.com/huggingface/huggingface_hub/blob/v1.32.0/src/huggingface_hub/cli/sandbox.py",
    "https://huggingface.co/docs/huggingface_hub/package_reference/cli"
  ],
  "rank": 0.90034,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-ce6b9d1ca4312a65-3:gate",
    "evidence_hash": "6ed38e3981f16aa5af27f57ebb3caa09482c2e8f2c23a4fa1336d9ccaaf35212"
  },
  "review": {
    "draft_hash": "18c9a0ca99d976deaf3db32e061e5f7b2565eb7d06e7c473761a2d0b9f4fdf51",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.90 >= 0.9; 2 needed) and Jev gave 0.71 (>= 0.6 needed)."
  }
}