A coding agent's chat is a log, and a log is where secrets end up: a token pasted to "just try it", a connection string in a stack trace, a key in an attached file. In my app, anything I store goes through a scrubber first.
The first layer is scrubbing by shape. Message text is stored with anything that looks like a secret removed, and what an agent supplies that gets saved goes through the same redaction. Attachments that look like keys or credentials are refused outright.
The lesson is that shape-matching is a net, not a wall. A secret that doesn't look like one, like a short password or an internal URL with a token in it, gets through.
So the second layer is a path that never touches the log. When an agent needs a secret from the person, its question gets a masked field, and the answer is kept out of the transcript. The real credentials sit in the OS keychain and everything else refers to them by an id.
The tip, then: scrub what you can by pattern, but don't make the pattern your only defence. Give people a place to put a secret that you've designed never to be logged, and make it the easy one.
Where it doesn't help: a secret typed into a normal message is still only protected by the pattern. And scrubbing the log doesn't un-send anything to the agent's own provider, so treat what you type into any agent as shared with it.
This is from building Styx, an open-source app that runs coding agents side by side.