Clone an environment without decrypting it

No, and that is the useful part. Duplicate copies the stored ciphertext directly rather than decrypting and re-encrypting, so it runs fine on a locked workspace. Any operation that has to compare or display values, such as push or environment compare, does need the key, because it genuinely cannot do its job without reading plaintext.

Because a version is a snapshot of one specific environment, and a rollback replays it into that environment. If a clone inherited the source history, rolling back would restore a set of values that were never actually in the clone, which is a footgun that only shows up during an incident. A clean history is the safe default; publish a version on the clone once it holds what you want.

No. A copy always lands beside its source: an environment copy stays in the same project, a project copy in the same product, and a product copy in the same workspace. There is no target selector anywhere, because the operation takes no request body at all. If you need the copy somewhere else, duplicate it in place and move on from there.

The copy stays private and keeps the same per-member access grants. That is the conservative choice: a clone that quietly became public, or that dropped its grants and fell back to workspace-wide visibility, would widen access at the exact moment nobody is looking. Change the grants afterwards if the copy is meant for a different group.

For some limits, yes, so it is worth knowing which. Duplicating checks the product and project allowances before it writes anything, and refuses outright rather than creating resources you are not entitled to. It does not check the environment or variable allowances, so cloning a project with many environments, or an environment with many variables, can leave you above those numbers. Nothing breaks, but treat the counts as something to review afterwards rather than something the clone guarantees.

You cannot choose, and that is the trade for it being one click. The copy takes the source name with " (copy)" appended, truncated to fit the 50-character limit, and a slug derived from that with a numeric suffix if one is already taken. Only the top level is renamed: nested projects, environments and variables keep their original names. Rename it afterwards if you want something else.

Not in this code path. The values are read as ciphertext, inserted as ciphertext, and never pass through a decryption step, which is the same property that lets publishing a version work without the key. Be precise about the scope of that claim: it says the duplicate operation performs no decryption, not that the server could not decrypt in general. What makes the server unable to read your values is that it never holds the key.