The snapshot that can't contain the secrets

Turning a dev environment into an artifact used to mean scrubbing it first: the .env, the cloud credentials, the keys buried in dotfiles. On Hoody, put credential material where the docs put it: /ramdisk/secrets, a mode-0700 directory backed by RAM. What lives there is never on a disk, never in a snapshot, never in a backup.

So the artifacts become safe to make. Snapshot the environment into the team's template library, archive the engagement, attach the machine state to a bug report: the secrets simply aren't in it, structurally, not because someone remembered to delete them. Decrypt keys into /ramdisk/secrets at session start; a host reboot wiping them is a feature, not an incident.

A snapshot can only leak what the disk contains, and the disk never contained it.