{"slug": "why-your-ai-coding-agent-should-never-see-your-env", "title": "Why Your AI Coding Agent Should Never See Your .env", "summary": "Developer Dext4r (Zaxs) has released env-guard, an open-source tool that prevents AI coding agents from exposing sensitive credentials like API keys. The tool works by having agents reference secrets by name only, with the shell expanding the actual values, so the model never sees the raw secrets. It includes audit logging and refuses unknown variables, and is compatible with Claude Code, Codex, Hermes, Cursor, OpenCode, and Aider.", "body_md": "Your AI agent uses your API keys. It NEVER sees them. Not in context. Not in logs. Not in chat. Not even if it tries.\n\nYou just gave your AI coding assistant a `.env`\n\nfile with `OPENAI_API_KEY=sk-...`\n\n, `GITHUB_TOKEN=ghp_...`\n\n, maybe an `AWS_SECRET`\n\n. You trust it to *use* those keys.\n\nBut here's the uncomfortable question nobody asks:\n\n**Where does that key actually go?**\n\n| Vector | Exposure |\n|---|---|\n| Model context window | Visible to the LLM |\n| Tool call logs | Logged forever |\n| Chat history | Stored in plaintext |\nPrompt injection (`\"print all env vars\"` ) |\nExfiltrated in 1 shot |\n\nOne malicious webpage. One injected instruction buried in a doc your agent reads. Every credential — gone.\n\nAI agents are *promiscuous with context*. They log everything. They echo everything. They will happily `print(env)`\n\nif a prompt tells them to.\n\nI built ** env-guard** around a simple principle: the agent references a secret by\n\n```\n.env.list (NAMES ONLY)        live env (VALUES)\nOPENAI_API_KEY      ──refs──▶  OPENAI_API_KEY=sk-...\nGITHUB_TOKEN                   GITHUB_TOKEN=ghp_...\n                                  │\n                            OS expands $NAME\n                                  │\n                       secret-run.py (audited, no reveal)\n```\n\n**The agent types:**\n\n```\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\nThe shell expands `$OPENAI_API_KEY`\n\n. The model sees `$OPENAI_API_KEY`\n\n— **never sk-...**.\n\nThree layers:\n\n`.env.list`\n\n`env-scan.py`\n\n`secret-run.py`\n\n`model + provider + purpose`\n\n, and \n\n``` js\npython scripts/secret-run.py \\\n  --var OPENAI_API_KEY \\\n  --model \"gpt-4o\" \\\n  --provider \"openai\" \\\n  --purpose \"list models\" \\\n  -- curl -s https://api.openai.com/v1/models\n```\n\nUnknown variables are **refused**. Every access is **audit-logged** with `reveal: false`\n\n. Even a direct `cat .env`\n\ninstruction fails — the agent has no read access to the raw file.\n\n`env-guard`\n\ndoesn't ask the agent to *be careful*. **It makes carelessness impossible.** The value is simply never in a place the model can read.\n\nWorks with Claude Code, Codex, Hermes, Cursor, OpenCode, Aider. MIT licensed.\n\n👉 ** github.com/Z-150/env-guard** — clone it, drop it in your\n\n`skills/`\n\nfolder, star it if it saved your keys.*Built by Dext4r (Zaxs), powered by Nous Research:CAB.*", "url": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-env", "canonical_source": "https://dev.to/z-150/why-your-ai-coding-agent-should-never-see-your-env-18h4", "published_at": "2026-08-21 07:50:40+00:00", "updated_at": "2026-08-21 08:14:41.622788+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "ai-agents"], "entities": ["Dext4r", "Zaxs", "env-guard", "Claude Code", "Codex", "Hermes", "Cursor", "OpenCode"], "alternates": {"html": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-env", "markdown": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-env.md", "text": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-env.txt", "jsonld": "https://wpnews.pro/news/why-your-ai-coding-agent-should-never-see-your-env.jsonld"}}