Secure workspace
Audit logs, scoped GitHub tokens, and Docker-isolated repo execution are built into every run.