The Agent Could Still Open .env

A reviewer opened a Friday pull request whose description claimed the coding agent never touched secrets. The agent had listed three application files, a passing test command, and a reminder that .env remained gitignored. Staging failed an hour later when another process printed a live key that had never left disk. Ignore files constrain version control, not every workspace reader that can still call open().

That incident is a composite of a pattern that appears once coding agents share ordinary developer checkouts. Teams repeat a handful of workspace claims because those claims sound like kernel guarantees rather than conventions. They remain hypotheses until you record the paths the tools actually opened during the session. This FAQ treats each repeated claim as a testable statement and replaces it with a corrected mental model.

What the agent wrote is not a filesystem trace

Most session summaries are after-the-fact narratives stitched from tool JSON, not append-only logs of open and exec. An agent can name a directory and still later read a gitignored child through a shell. Fluency is cheap on current coding models, and omission stays cheap when nobody asked for a read inventory. If you cannot point to a path list, you do not yet know the working set.

Reproducing the checks requires a checkout, a tool-using agent, and a writable trace file, not a private GPU. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source coding-agent project with free-tier model access and an optional free server for scratch workspaces. Those options matter only as a disposable host for the audit, which does not depend on a named model.

Myth: gitignore means the agent cannot read the file

Developers treat .gitignore as a privacy boundary because git status hides the same paths they care about. Git ignore rules only change which paths enter the index, the object database, and some porcelain listings. A coding agent that receives a shell can run cat .env without asking git for permission. Treating gitignore as a sandbox is like treating a packing list as a lock on the suitcase you already opened.

You can demonstrate the split on any clone that still has a local env file. The first command shows git's opinion of the path, while the second shows the kernel's opinion. If the Python one-liner prints content, an agent with the same user identity can print it too. Asking the model not to read secrets remains a request, not a syscall filter.

git check-ignore -v .env || echo "git does not ignore this path"
python -c "print(open('.env','r',encoding='utf-8',errors='replace').read()[:80])"

If the second command prints anything, the agent can print it under the same user. Policy text in the prompt will not survive a later tool call that looks more useful than obedience. Teams that need a real boundary have to move the file out of the reachable tree or drop the unrestricted shell. Logging the successful read still helps after the fact, but that record remains forensics rather than prevention.

Myth: naming three folders means the agent loaded the monorepo

Session write-ups often list apps/web, packages/ui, and services/api as if those labels implied recursive ingestion. Listing a path is a speech act, whereas reading a path is an I/O act with a byte count. Many agents grep first, open the hits, and then summarize from those hits plus priors about similar trees. The corrected model treats every claimed file as unread until a trace shows a successful open.

A small JSONL log is enough to keep that distinction honest during a session. Each tool wrapper should append one record before it returns bytes to the model. Until that file exists, repository understanding is just a fluent list of plausible names. Counting unique resolved paths tells you more than counting tokens in the explanation.

# read_trace.py — labeled example for a local tool wrapper
import json, os, time
from pathlib import Path

TRACE = Path(os.environ.get("AGENT_READ_TRACE", "agent_reads.jsonl"))

def record_open(path: str, ok: bool, nbytes: int, via: str) -> None:
    rec = {
        "ts": time.time(),
        "path": str(Path(path).resolve()),
        "ok": ok,
        "nbytes": nbytes,
        "via": via,
        "pid": os.getpid(),
    }
    with TRACE.open("a", encoding="utf-8") as fh:
        fh.write(json.dumps(rec) + "\n")

The wrapper is deliberately boring so you can paste it around open, read_file, or a shell cat helper. It does not parse git, and it does not redact values, which keeps the failure mode visible. If wrapping every tool is too heavy, start with the shell tool, because that is where ignore rules usually die. Review the JSONL file before you spend time reviewing the agent's markdown summary.

Myth: a successful tool object means the command did the useful thing

Agents frequently return a zero exit for npm test, pytest, or cargo check inside a compact JSON object. Exit zero can mean tests ran, a stub script echoed success, or the working directory was empty. A zero exit is a receipt for a process start, not a photograph of the meal you thought you ordered. Without a binary path, a cwd, and an output digest, a green object is just another fluent sentence.

# labeled example: bind the command to cwd, binary, and output hash
cd /workspace/app
readlink -f "$(command -v pytest)"
pytest -q --maxfail=1 | tee /tmp/pytest.out
sha256sum /tmp/pytest.out

Compare the digest with whatever the agent pasted into the chat transcript after the tool returned. Disagreement means the summary drifted or the workspace moved under the process. Either failure is cheaper to catch on the digest than after a green badge in production. Keep the tee file beside the trace so later reviewers can replay the same bytes.

Myth: a free shared server isolates uncommitted files from model context

Teams sometimes assume a complimentary remote workspace behaves like a personal laptop with slightly better uptime. A free server is still a computer with a user, a disk, and a tool broker sitting in front of that disk. Isolation comes from accounts, containers, and network policy, not from the adjective free. Uncommitted env files and old traces stay readable until you delete them or start from a fresh tree.

The useful habit is to treat each finished session as a working set that you enumerate on disk. After the agent stops, join the trace with git ignore rules and a cheap secret-shaped name check. The classifier below is a proposal you can run locally; it is not a claim about any hosted scanner. A non-zero exit should mean more than a polite closing sentence from the model.

# workspace_read_audit.py
"""Classify recorded agent reads against git ignore rules and simple secret names."""
from __future__ import annotations

import json, re, subprocess, sys
from pathlib import Path

SECRETISH = re.compile(
    r"(\.env($|\.)|credentials|id_rsa|id_ed25519|\.pem$|\.p12$|secret)",
    re.I,
)

def git_ignored(path: str) -> bool:
    r = subprocess.run(
        ["git", "check-ignore", "-q", "--", path],
        capture_output=True,
    )
    return r.returncode == 0

def classify(path: str) -> str:
    name = Path(path).name
    if SECRETISH.search(path) or SECRETISH.search(name):
        return "secretish"
    if git_ignored(path):
        return "gitignored"
    return "tracked_or_unknown"

def main(trace: Path) -> int:
    if not trace.exists():
        print(f"missing trace: {trace}", file=sys.stderr)
        return 2
    counts = {"secretish": 0, "gitignored": 0, "tracked_or_unknown": 0}
    for line in trace.read_text(encoding="utf-8").splitlines():
        rec = json.loads(line)
        if not rec.get("ok"):
            continue
        bucket = classify(rec["path"])
        counts[bucket] += 1
        print(f"{bucket:20} {rec.get('nbytes', 0):7} {rec['path']}")
    print("---")
    print(counts)
    return 0 if counts["secretish"] == 0 else 1

if __name__ == "__main__":
    sys.exit(main(Path(sys.argv[1] if len(sys.argv) > 1 else "agent_reads.jsonl")))

Run the classifier from the same checkout the agent used, because path resolution follows the host the process actually saw. A non-zero exit means at least one successful read matched a secret-shaped path. That signal beats a closing apology in the transcript, and it is cheap enough to repeat after every session. Store traces as paths and sizes only unless you are prepared to treat the log as secret material.

python workspace_read_audit.py agent_reads.jsonl
echo $?

Myth: a policy sentence in the system prompt is a sandbox

Prompts such as never read environment files fail the way linter comments fail, because they are text competing with other text. Tool-using agents optimize for finishing the user task, and reading .env.local is often the fastest path to a boot. The corrected model puts prevention outside the model, using a dedicated user, a bind-mounted subset, or a command allow-list. If you cannot change the sandbox yet, fail closed on the audit for agent-authored branches.

# labeled CI fragment, not a complete pipeline
git checkout "$AGENT_BRANCH"
python workspace_read_audit.py agent_reads.jsonl
test "$(python workspace_read_audit.py agent_reads.jsonl >/dev/null; echo $?)" -eq 0

That gate will not stop a determined shell from printing a key during the live session itself. It will stop the team from merging a session that already looked unclean in the trace. Detection after the fact is not a sandbox, and calling it one will recreate the Friday outage. Use the gate as a review aid while you work toward an actual allow-list.

A corrected working set, not a wiser ghost

The mental model that survives these checks is intentionally boring and slightly unkind to chat UIs. A coding agent is a program that proposes edits and sometimes runs tools against a tree. The workspace is a disk with permissions, git ignore is a commit filter, and model context is a truncated buffer. Those four objects collapse into one transcript, which is why the myths keep getting airtime.

This approach is the wrong tool if you need hard multi-tenant isolation or a guarantee that prompts never leave your rack. Detection scripts do not replace seccomp profiles, ephemeral virtual machines, or secret managers that never write values into the tree. People who copy production env files into a shared free-tier directory to speed the agent should stop first. The samples above assume a disposable clone and an operator who already knows which files are toxic.

If you want a disposable host for this audit, MonkeyCode's free-tier models and free server can host a throwaway clone. That is an optional rehearsal environment, not a requirement for the classifier to work. The value remains the log you keep, not the brand sitting on the workspace you happened to use. Delete the clone after the audit so yesterday's env file cannot become tomorrow's model context.

MonkeyCode provides free models that can run this workflow.