Policy evaluation fails closed by default. Operations that lack explicit policy decisions are rejected.

Secrets support multiple sensitivity levels with appropriate controls.

• →Sealed values cannot be unsealed
• →Deployment injection requires explicit policy grant
• →Secret audit logs capture injection events

# Sensitive: encrypted in storage, readable with permission
neb env set API_KEY --sensitive

# Sealed: encrypted and cannot be read in plaintext
neb env set CRITICAL_SECRET --sealed

Better Auth RS owns authentication. Nebula owns authorization scoped to galaxies and repositories.

# Nebula scope example
nebula.repository:read_blob
nebula.repository:sync_objects
nebula.galaxy:sync_objects

Report security vulnerabilities through the repository's security advisory channel.