Merge branch 'main' into sophie-6496

content/codespaces/codespaces-reference/security-in-github-codespaces.md

@@ -83,7 +83,9 @@ Codespaces are designed to be security hardened by default. To help maintain thi
 
 Always use encrypted secrets when you want to use sensitive information (such as access tokens) in a codespace. You can access your secrets as environment variables in the codespace, including from the terminal. For example, you can launch a terminal within your codespace and use `echo $SECRET_NAME ` to see the value of a secret.
 
-The secret values are copied to environment variables whenever the codespace is resumed or created, so if you update a secret value while the codespace is running, you’ll need to suspend and resume to pick up the updated value.
+The secret values are copied to environment variables whenever the codespace is resumed or created and are also synced when they are changed.
+
+Secrets are not copied into the environment if you don't have write access to the codespace's repository.
 
 For more information on secrets, see:
 - "[Managing encrypted secrets for your codespaces](/codespaces/managing-your-codespaces/managing-encrypted-secrets-for-your-codespaces)"
@@ -95,6 +97,8 @@ When you create a codespace from a PR branch from a fork, the token in the codes
 - For a private repository, the codespace is granted access to both the fork and parent.
 - For a public repository, the codespace will only have access to the fork and opening PRs on the parent.
 
+We also further protect you in these scenarios by not injecting any of your [codespace secrets](/codespaces/managing-your-codespaces/managing-encrypted-secrets-for-your-codespaces) into the environment.
+
 ### Additional good practices
 
 There are some additional good practices and risks that you should be aware of when using {% data variables.product.prodname_codespaces %}.