Sandboxes

Every task runs in its own sandbox — an isolated environment with a fresh checkout of your repo, scoped credentials, and a place for the agent to run commands and your test suite. When the task finishes, the sandbox is torn down.

Sandboxes are fully managed and isolated per task and per workspace, so one run can never see another's code or credentials. The agent only ever works inside the sandbox on a branch; nothing runs against your production environment.