# Why Your AI Coding Agent Should Never See Your .env

> Source: <https://dev.to/z-150/why-your-ai-coding-agent-should-never-see-your-env-18h4>
> Published: 2026-08-21 07:50:40+00:00

Your AI agent uses your API keys. It NEVER sees them. Not in context. Not in logs. Not in chat. Not even if it tries.

You just gave your AI coding assistant a `.env`

file with `OPENAI_API_KEY=sk-...`

, `GITHUB_TOKEN=ghp_...`

, maybe an `AWS_SECRET`

. You trust it to *use* those keys.

But here's the uncomfortable question nobody asks:

**Where does that key actually go?**

| Vector | Exposure |
|---|---|
| Model context window | Visible to the LLM |
| Tool call logs | Logged forever |
| Chat history | Stored in plaintext |
Prompt injection (`"print all env vars"` ) |
Exfiltrated in 1 shot |

One malicious webpage. One injected instruction buried in a doc your agent reads. Every credential — gone.

AI agents are *promiscuous with context*. They log everything. They echo everything. They will happily `print(env)`

if a prompt tells them to.

I built ** env-guard** around a simple principle: the agent references a secret by

```
.env.list (NAMES ONLY)        live env (VALUES)
OPENAI_API_KEY      ──refs──▶  OPENAI_API_KEY=sk-...
GITHUB_TOKEN                   GITHUB_TOKEN=ghp_...
                                  │
                            OS expands $NAME
                                  │
                       secret-run.py (audited, no reveal)
```

**The agent types:**

```
curl -H "Authorization: Bearer $OPENAI_API_KEY" https://api.openai.com/v1/models
```

The shell expands `$OPENAI_API_KEY`

. The model sees `$OPENAI_API_KEY`

— **never sk-...**.

Three layers:

`.env.list`

`env-scan.py`

`secret-run.py`

`model + provider + purpose`

, and 

``` js
python scripts/secret-run.py \
  --var OPENAI_API_KEY \
  --model "gpt-4o" \
  --provider "openai" \
  --purpose "list models" \
  -- curl -s https://api.openai.com/v1/models
```

Unknown variables are **refused**. Every access is **audit-logged** with `reveal: false`

. Even a direct `cat .env`

instruction fails — the agent has no read access to the raw file.

`env-guard`

doesn't ask the agent to *be careful*. **It makes carelessness impossible.** The value is simply never in a place the model can read.

Works with Claude Code, Codex, Hermes, Cursor, OpenCode, Aider. MIT licensed.

👉 ** github.com/Z-150/env-guard** — clone it, drop it in your

`skills/`

folder, star it if it saved your keys.*Built by Dext4r (Zaxs), powered by Nous Research:CAB.*