Yes. All hardening runs in your environment or GitHub Actions. We generate cryptographic attestations (Sigstore) so you can verify that metadata hasn’t been tampered with. We never require access to your production secrets or customer data.
June 1, 2026