> ## Documentation Index
> Fetch the complete documentation index at: https://upstash-dx-2885.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Secrets

## Isolation

Every Upstash Box runs in its own isolated container with a dedicated filesystem, process tree, and network stack. Boxes cannot communicate with or observe each other. Network access is restricted — containers cannot reach private networks, cloud metadata services, or other internal infrastructure.

## Environment Variables

You can pass environment variables when creating a box. These are available to all code running inside the box, including your agent and any user-submitted code.

<CodeGroup>
  ```typescript box.ts theme={null}
  const box = await Box.create({
    runtime: "node",
    env: {
      DATABASE_URL: "postgres://...",
      ANTHROPIC_API_KEY: "sk-ant-...",
    },
  })
  ```

  ```python box.py theme={null}
  box = Box.create(
      runtime="node",
      env={
          "DATABASE_URL": "postgres://...",
          "ANTHROPIC_API_KEY": "sk-ant-...",
      },
  )
  ```
</CodeGroup>

<Warning>
  Environment variables are visible to all code running inside the box. If you run untrusted code, those secrets can be read by the untrusted code. For sensitive credentials, use [Attach Headers](/box/overall/attach-headers) instead.
</Warning>

## Attach Headers

For injecting secret HTTP headers into outbound HTTPS requests without exposing them inside the container, see [Attach Headers](/box/overall/attach-headers).

## Browser URLs

Boxes created with [`browser: true`](/box/overall/browser/overview) can hand out two kinds of URLs that carry their access token in the URL itself, so they work without an API key:

* [Live view](/box/overall/browser/live-view) URLs are **view-only**. Frames stream out and no input goes in, but anyone with the URL can watch the tab.
* [CDP](/box/overall/browser/connect) URLs give **full control** of the browser to anyone holding them.

Treat both as secrets and share them only where that level of access is intended. Recording playlist URLs are not tokenized. Fetching them requires your Box API key, like any other API call.

## Blocked Environment Variables

For system security, the following environment variables cannot be set:

| Variable          | Reason                               |
| ----------------- | ------------------------------------ |
| `PATH`            | Prevents binary hijacking            |
| `HOME`            | Prevents home directory manipulation |
| `LD_PRELOAD`      | Prevents shared library injection    |
| `LD_LIBRARY_PATH` | Prevents library path hijacking      |
| `NODE_OPTIONS`    | Prevents Node.js flag injection      |

All other environment variables — including `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, and their `*_BASE_URL` variants — are allowed. The built-in agent runner uses its own isolated environment that overrides these per-run.