DEV Community

Vagebond
Vagebond

Posted on

Your agent reads .env. It can't read a vault.

#llm #security #agents

You give an AI agent a shell in your project. The project has a .env file. The agent can read it.

Most advice offers two fixes: an ignore file and deny rules. Both help. Both leave gaps. Here is where, with commands you can try.

The ignore file

An ignore file only works for the tools that read it. It can hide a file from search. It does not stop a shell command.

cat .env
Enter fullscreen mode Exit fullscreen mode

If the agent can run commands, it can print the file.

Deny rules

Claude Code lets you deny tools in .claude/settings.json:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Bash(cat:*)"]
  }
}
Enter fullscreen mode Exit fullscreen mode

Now try these:

head .env
grep KEY .env
sed -n p .env
python3 -c "print(open('.env').read())"
Enter fullscreen mode Exit fullscreen mode

Each rule names one path or one command. The list of other ways to read a file is long.

The environment

Many keys never sit in the repo. You export them in your shell profile:

export OPENAI_API_KEY=sk-...
Enter fullscreen mode Exit fullscreen mode

The agent starts from that shell. Every child process inherits the variable.

printenv
echo $OPENAI_API_KEY
Enter fullscreen mode Exit fullscreen mode

No ignore file or deny rule covers that.

Settings that help

  • Keep .env out of the folder you open the agent in.
  • Deny Read on secret paths, as above.
  • Keep Bash on ask, not allow.
  • Don't export keys in ~/.zshrc. Start the agent from a clean shell.

These shrink the gap. They don't close it. As long as the secret is in a file or in the environment, the agent can reach it.

One fix: give the key to the command

Kluis is a password vault for the Mac, for the terminal and the desktop. Your secrets live in the vault, not in plain files.

kluis run gives a secret to one command. The secret is gone when that command ends.

  1. The agent asks kluis run to start a command with a secret.
  2. Touch ID confirms the read.
  3. The command gets the secret. The agent gets the output.

The key goes to the command, never back to the agent. The agent can use a secret without reading it. A policy limits what it can use. Every read goes into an audit log.

To move what is already lying around, an import scan finds keys and passwords in your files.

What Kluis is not

Kluis does not sandbox your agent. A secret you leave in a plain file stays readable. Kluis helps once the secret is in the vault.

It requires macOS 14 or later on Apple silicon. It is free. No account, no server.

The docs and the download are on the Kluis site:

https://baken.vagebond.nl/r/TbrWtFJg

Top comments (0)