Why Your AI Coding Agent Should Never See Your .env

Developer Dext4r (Zaxs) has released env-guard, an open-source tool that prevents AI coding agents from exposing sensitive credentials like API keys. The tool works by having agents reference secrets by name only, with the shell expanding the actual values, so the model never sees the raw secrets. It includes audit logging and refuses unknown variables, and is compatible with Claude Code, Codex, Hermes, Cursor, OpenCode, and Aider.

Your AI agent uses your API keys. It NEVER sees them. Not in context. Not in logs. Not in chat. Not even if it tries. You just gave your AI coding assistant a .env file with OPENAI API KEY=sk-... , GITHUB TOKEN=ghp ... , maybe an AWS SECRET . You trust it to use those keys. But here's the uncomfortable question nobody asks: Where does that key actually go? | Vector | Exposure | |---|---| | Model context window | Visible to the LLM | | Tool call logs | Logged forever | | Chat history | Stored in plaintext | Prompt injection "print all env vars" | Exfiltrated in 1 shot | One malicious webpage. One injected instruction buried in a doc your agent reads. Every credential — gone. AI agents are promiscuous with context . They log everything. They echo everything. They will happily print env if a prompt tells them to. I built env-guard around a simple principle: the agent references a secret by .env.list NAMES ONLY live env VALUES OPENAI API KEY ──refs──▶ OPENAI API KEY=sk-... GITHUB TOKEN GITHUB TOKEN=ghp ... │ OS expands $NAME │ secret-run.py audited, no reveal The agent types: curl -H "Authorization: Bearer $OPENAI API KEY" https://api.openai.com/v1/models The shell expands $OPENAI API KEY . The model sees $OPENAI API KEY — never sk-... . Three layers: .env.list env-scan.py secret-run.py model + provider + purpose , and js python scripts/secret-run.py \ --var OPENAI API KEY \ --model "gpt-4o" \ --provider "openai" \ --purpose "list models" \ -- curl -s https://api.openai.com/v1/models Unknown variables are refused . Every access is audit-logged with reveal: false . Even a direct cat .env instruction fails — the agent has no read access to the raw file. env-guard doesn't ask the agent to be careful . It makes carelessness impossible. The value is simply never in a place the model can read. Works with Claude Code, Codex, Hermes, Cursor, OpenCode, Aider. MIT licensed. 👉 github.com/Z-150/env-guard — clone it, drop it in your skills/ folder, star it if it saved your keys. Built by Dext4r Zaxs , powered by Nous Research:CAB.