# Egress, secrets and the metadata address

Lesson 2 of [Security review of an agent sandbox provider](https://agentsandboxes.fyi/academy/review-agent-sandbox-security.md), 18 minutes.

Data leaves a sandbox through the network. Credentials leak when they are inside the boundary. Review both together. Deny by default Start with no outbound access. Allow only the named hosts and ports that the task needs. Log every blocked request. A blocked request is an early warning. Block intern…

The rest of this lesson is for learners enrolled in the course. [See how Security review of an agent sandbox provider works](https://agentsandboxes.fyi/academy/review-agent-sandbox-security.md).

Also on the [web page](https://agentsandboxes.fyi/academy/review-agent-sandbox-security/egress-secrets-and-metadata).