# Secrets: Security model

> Where values live and who can see them.

Glider documentation · Data · Web page: https://cgglider.com/docs/secrets/security/

Sections of this page: [Managing secrets](https://cgglider.com/docs/secrets.md) · [Using them](https://cgglider.com/docs/secrets/using.md) · [Security model](https://cgglider.com/docs/secrets/security.md)

- Values live on the server, in a per-page file beside the page itself; deleting the last secret removes the file.
- They are never sent to the browser, never included in a saved page, and never in an SSE frame.
- A probe runs server-side precisely so the substituted request never exists client-side.
- Agents can see that a secret exists and reference it by name; they cannot read the value.

> **Back-ups carry secrets:** data/pages/*.secrets.json holds plain values on disk. Treat a copy of the data directory with the same care as the keys themselves.