● T0 untrusted● T1 standard● T2 secrets● T3 dedicated
Zero-trust posture. Secrets are never sent to third-party marketplace runners. Fork PRs and public-repo jobs run at Tier 0 (no secrets, no network, strong sandbox). Raising a repo's max tier or enabling secrets increases risk — every such control is explained inline before you can enable it.