New in Hermes Agent: a credential firewall for Docker sandboxes. Your real keys never enter the sandbox. It runs on stand-in tokens, and a local proxy swaps in the real keys at the network boundary. Tokens from a compromised sandbox are useless elsewhere. > hermes egress setup