# Environments

An environment holds what a new sandbox starts with: variables, secret files, repositories and a credential profile.

```sh
ENV=$(harebox env new --name staging | jq -r .id)
harebox env var set "$ENV" GREETING --value hello
harebox new --name uses-env --environment staging
harebox exec current -- env
```

Each change makes a new version. Running sandboxes stay on their version until you upgrade them.

```sh
ENV=$(harebox env new --name upgrades | jq -r .id)
harebox env upgrade "$ENV"
```

## Passing nothing of yours

For sandboxes that other people use, pass nothing of yours. Set `third_party_safe` on the environment, or start with `--no-env`.

```sh
harebox new --name tenant --no-env
```

Values are stored encrypted, and the API never returns them.