A secret can go to only some of your sandboxes

A secret reached every sandbox of the account; it can now name the sandboxes that get it, by label or by id. runtime secrets set NAME --host api.example.com --only-label role=hub (once per selector) or --only-sandbox <id> gives it to those alone, --all-sandboxes gives it to every sandbox again, and runtime secrets scope NAME changes who gets an existing secret without its value. The API takes only (and PUT /v1/egress-secrets/{name}/sandboxes), the SDKs only and secrets.scope, and MCP the same only. A new value keeps the scope it had. Settings → Secrets sets the scope and shows which sandboxes each secret reaches, and GET /v1/egress-secrets gives each scoped secret's reaches. See secrets sandboxes never see.