The stranger's pull request gets a preview with AI turned on

An outside contributor opens a PR against your open-source project. The feature they touched calls a model. On most setups the preview build either skips AI entirely or runs with a maintainer's key exposed to a branch nobody has reviewed yet.

On Hoody every PR gets a snapshot-cloned container, and every container authenticates to the gateway as itself. The preview deploys, the AI feature works, and the contributor's branch: which could contain anything: has access to a token that is useless off your server. If the branch turns out hostile, PATCH ai: false on that one container, or close the PR and delete it.

Maintainers review the diff, not the secrets policy for previews.