Bolt SIMD Secret Scrubbing

Injecting API keys (OpenAI, AWS, GitHub) into container environment variables is dangerous—a compromised LLM or guest tool can inspect /proc/self/environ and exfiltrate secrets.

The Bolt SIMD Architecture

RunVero implements a zero-exposure secret vault:

1. Host-Side Vault: Real secret values reside exclusively in the host control plane memory.
2. Opaque Placeholders: The guest tool receives only an opaque token placeholder (e.g. {{RUNVERO_SECRET_0}}).
3. Outbound SIMD Substitution: When the guest tool initiates an authorized outbound HTTP request, RunVero’s Bolt SIMD engine replaces the placeholder with the real secret at line speed using SIMD Aho-Corasick algorithms.
4. Response Sanitization: When the tool execution completes, any accidental reflection of the secret in logs or error traces is automatically redacted back into placeholders.

[ LLM Agent Context ] ──> Sees only: {{RUNVERO_SECRET_0}}
                                │
[ WASI Sandbox Guest ] ──> Operates on placeholder
                                │
[ Outbound HTTP Hook ] ──> Bolt SIMD replaces with real API key (< 12 µs)
                                │
[ Remote Destination ] ──> Receives real Bearer token