DEV Community

z-150
z-150

Posted on Originally published at github.com

Why Your AI Coding Agent Should Never See Your .env

#ai #security #llm #devops

Why Your AI Coding Agent Should Never See Your .env

Your AI agent uses your API keys. It NEVER sees them. Not in context. Not in logs. Not in chat. Not even if it tries.

You just gave your AI coding assistant a .env file with OPENAI_API_KEY=sk-..., GITHUB_TOKEN=ghp_..., maybe an AWS_SECRET. You trust it to use those keys.

But here's the uncomfortable question nobody asks:

Where does that key actually go?

The Problem (That Nobody Talks About)

Vector Exposure
Model context window Visible to the LLM
Tool call logs Logged forever
Chat history Stored in plaintext
Prompt injection ("print all env vars") Exfiltrated in 1 shot

One malicious webpage. One injected instruction buried in a doc your agent reads. Every credential — gone.

AI agents are promiscuous with context. They log everything. They echo everything. They will happily print(env) if a prompt tells them to.

The Solution: Reference, Not Reveal

I built env-guard around a simple principle: the agent references a secret by name, and the OS expands it at execution time. The raw value is never in a place the model can read.

.env.list (NAMES ONLY)        live env (VALUES)
OPENAI_API_KEY      ──refs──▶  OPENAI_API_KEY=sk-...
GITHUB_TOKEN                   GITHUB_TOKEN=ghp_...
                                  │
                            OS expands $NAME
                                  │
                       secret-run.py (audited, no reveal)
Enter fullscreen mode Exit fullscreen mode

The agent types:

curl -H "Authorization: Bearer $OPENAI_API_KEY" https://api.openai.com/v1/models
Enter fullscreen mode Exit fullscreen mode

The shell expands $OPENAI_API_KEY. The model sees $OPENAI_API_KEY — never sk-....

How It Works

Three layers:

  1. .env.list — auto-generated index of variable names only (no values), via env-scan.py
  2. Live env — real values stay in the OS environment, never written to disk by the agent
  3. secret-run.py — runs the command with the variable in child env, logs model + provider + purpose, and refuses to echo the value 
python scripts/secret-run.py \
  --var OPENAI_API_KEY \
  --model "gpt-4o" \
  --provider "openai" \
  --purpose "list models" \
  -- curl -s https://api.openai.com/v1/models
Enter fullscreen mode Exit fullscreen mode

Unknown variables are refused. Every access is audit-logged with reveal: false. Even a direct cat .env instruction fails — the agent has no read access to the raw file.

Why This Matters

env-guard doesn't ask the agent to be careful. It makes carelessness impossible. The value is simply never in a place the model can read.

Works with Claude Code, Codex, Hermes, Cursor, OpenCode, Aider. MIT licensed.

👉 github.com/Z-150/env-guard — clone it, drop it in your skills/ folder, star it if it saved your keys.

Built by Dext4r (Zaxs), powered by Nous Research:CAB.

Top comments (0)