Keep it safe
A quick checklist to keep your users' information safe - where secrets actually live on Emergent, what your AI agent can see, and how to protect data before you publish.
Where secrets live: .env in preview, Secrets in production
On Emergent, "environment variables" and "secrets" are the same thing: key-value pairs like STRIPE_KEY=sk_… that your app reads at runtime. They live in two separate places:
- Preview: secrets live in
.envfiles inside your project's code. The agent manages these: to add a new key, ask the agent in chat to add it to.env(give the key a name; put the real value in yourself afterwards, see the warning below). - Production (your live app): secrets live in the Secrets tab (click Preview, then Manage). There you'll see System keys (platform-managed, like your database connection, don't touch) and Custom keys (yours).
How the two connect: on your first Publish, the values in your .env files carry over to production. After that, the two sets are separate, changing a preview value does not change production. To update a live value: Preview → Manage → Secrets → edit the Custom key → Save and re-publish. New keys can't be created from the Secrets panel, they're added via the agent in .env, then picked up on the next Re-publish.
Anything you type in chat is sent to the AI provider. So: have the agent create the key name in .env, then put the real value in yourself, in the Secrets tab (Preview → Manage → Secrets → Custom keys → Save and republish) for your live app. If you already pasted a secret in chat, rotate that key with your provider.
Secret values are masked in the panel by default, but they can be revealed and copied by anyone with publish access to your project. Treat project access as secret access.
What the AI sees (and doesn't see)
Your agent needs context to build your app, but Emergent keeps sensitive data out of its view:
| What the agent sees | What it never sees |
|---|---|
Your code files (including .env in preview) |
Secret values from the Secrets tab (production) |
| Your database's structure (table names, field types) | Actual database records (unless you paste them) |
| Secret key names | Production secret values |
| Your prompts and chat history | Other users' projects |
Your projects, chat logs, code, and secrets are never shared with other users or used to train LLMs. Emergent isolates every workspace and encrypts data in transit and at rest.
AI providers (OpenAI, Anthropic, etc.) process your prompts and code to respond, but - per their enterprise terms - they do not train public models on API traffic from commercial use.
Add login if users need private data
Once your app is live, anyone with the URL can visit it. If each person should only see their own orders, messages, or profile, you need user accounts and authentication.
See Add login & user accounts for a step-by-step guide to adding sign-in flows and protecting private data behind login screens.
Without login, all data in your app is visible to anyone who finds the link - so plan access control before you share your app publicly.
Pre-launch safety checklist
Before you show your app to real users, run through these quick checks:
- Secrets in
.env/ the Secrets tab? - No API keys or passwords hard-coded in source files, and none ever pasted in chat. - Production values set? - After your first Publish, check Preview → Manage → Secrets and confirm your Custom keys carry the right live values (test keys swapped for live ones where that applies).
- Login tested? - If your app has user accounts, sign in as a test user and confirm they can't see another user's data.
- Public URL reminder - Your live app is accessible to anyone with the link. If that's not what you want, add authentication or take the app offline.
Do not hard-code sensitive data in client-side JavaScript or HTML - use secrets and server-side logic to protect them.
If something looks wrong
If you accidentally pasted a secret value in chat, add the key properly (agent → .env, value via the Secrets tab), then rotate that key with your provider so the old one can't be used.
If you suspect a data leak or access issue, contact support@emergent.sh - the team can help audit logs and lock down your workspace.
Go deeper: Secrets & env variables
