{"slug": "your-ai-coding-agent-can-read-env-heres-how-to-stop-secrets-before-they-reach", "title": "Your AI Coding Agent Can Read .env — Here’s How to Stop Secrets Before They Reach the Cloud", "summary": "A developer built Anonmyz, an open-source local DLP proxy that intercepts AI coding agent traffic to mask secrets before they reach cloud model providers. The tool scans outbound requests for sensitive patterns, replaces them with placeholders, and restores them locally, preventing accidental exposure via prompts. It handles streaming responses with a look-behind window to avoid missing secrets split across chunks.", "body_md": "AI coding agents do much more than autocomplete.\n\nTools such as Claude Code, Codex, Cursor, Aider, and Cline can read files, inspect directory trees, execute terminal commands, and feed the results back into a model. That context is what makes them useful—but it also creates a new path for accidental data exposure.\n\nImagine asking an agent to debug a failing deployment. It runs:\n\ncat .env\n\nThe output contains values like these:\n\nDATABASE_URL=postgres://admin:EXAMPLE_PASSWORD@internal-db:5432/app\n\nGITHUB_TOKEN=ghp_EXAMPLE_TOKEN_NOT_REAL\n\nINTERNAL_API_KEY=sk-example-not-a-real-key\n\nThe agent may include that command output in its next model request. At that point, the values are no longer only on your machine—they have become part of the outbound prompt.\n\n.gitignore does not prevent this. Secret scanning at commit time does not prevent it either. The secret does not have to enter Git history to leave the workstation.\n\nI wanted a control at the actual boundary: immediately before coding-agent traffic leaves the machine.\n\nSo I built Anonmyz, an open-source, local DLP proxy for AI coding agents.\n\nThe basic idea\n\nAnonmyz runs on the developer’s machine between the AI client and the model provider.\n\nFor each supported request, it:\n\nIntercepts the outbound request locally.\n\nScans its JSON body for supported secret and sensitive-data patterns.\n\nReplaces detected values with cryptographically random placeholders.\n\nStores the placeholder-to-value mapping in a request-scoped, in-memory vault.\n\nSends only the sanitized request to the configured model provider.\n\nRestores placeholders locally when the standard or streamed response returns.\n\nClears the request-scoped vault after the exchange finishes.\n\nThe model can still reason about the structure of the prompt, but it does not need to see the original credential.\n\nWhat the provider sees\n\nConsider an outbound request containing this text:\n\n{\n\n\"input\": \"Debug this config: GITHUB_TOKEN=ghp_EXAMPLE_TOKEN_NOT_REAL\"\n\n}\n\nAfter local masking, the provider receives something conceptually similar to:\n\n{\n\n\"input\": \"Debug this config: GITHUB_TOKEN=[[GITHUB_TOKEN_7F3A9C2D]]\"\n\n}\n\nThe original value remains in the local request vault. If the model includes the placeholder in its response, Anonmyz replaces it locally before returning the response to the coding agent.\n\nThis is different from permanently replacing every finding with [REDACTED]. A unique placeholder preserves identity and context: the model can distinguish two different values without learning either value, and the local workflow can remain coherent on the return path.\n\nStreaming makes this harder than it looks\n\nMost coding agents stream model output using Server-Sent Events. A placeholder—or even a raw secret in an unsafe upstream response—can be split across arbitrary network chunks.\n\nA naive implementation that scans each chunk independently can miss this:\n\nchunk 1: sk-example-part-\n\nchunk 2: two-not-a-real-key\n\nNeither chunk necessarily matches a complete credential pattern by itself.\n\nAnonmyz therefore keeps a bounded look-behind window while processing the stream. It delays emitting bytes that might be the beginning of a supported secret or placeholder, scans the combined boundary, and fails closed when the response cannot be handled safely.\n\nThis chunk-boundary behavior is covered with split-position tests rather than assuming that one network read equals one logical token or SSE event.\n\nWhy a local proxy?\n\nSending a prompt to a cloud DLP service before sending it to a cloud model creates another party that receives the sensitive prompt.\n\nAnonmyz keeps the detection and reversible mapping on the workstation. The cloud provider receives the sanitized request; the mapping needed to reverse it remains local and in memory for that exchange.\n\nThe current implementation provides:\n\nA loopback reverse-proxy mode for configurable AI clients\n\nAn optional transparent MITM mode restricted to allowlisted AI domains\n\nStandard-response and SSE streaming support\n\nRequest-scoped in-memory vaults\n\nProvider adapters and allowlisted header forwarding\n\nLocal metadata-only audit and metrics endpoints\n\nA Codex Safe Session launcher\n\nVS Code integration and a beta JetBrains integration\n\nThe core is written with the Go standard library and builds as a single binary. There is no Python or Node.js runtime required for the proxy, and Docker is optional rather than mandatory.\n\nWhat it looks for\n\nAnonmyz is designed to detect supported patterns such as:\n\nAPI keys and provider tokens\n\nGitHub tokens\n\nSSH private-key blocks\n\nInline passwords and credentials\n\nSensitive local file paths\n\nOther configured organization-specific patterns\n\nPattern matching is only one layer. Where useful, semantic validators reduce obvious false positives—for example, by checking whether a candidate has the expected structure instead of treating every random-looking string as a credential.\n\nNo detector recognizes every possible secret format. Unknown proprietary formats need custom patterns, and low-entropy values such as ordinary dictionary passwords are inherently difficult to identify without context.\n\nThe threat model matters\n\nAnonmyz is intended to reduce accidental disclosure of supported secrets through AI traffic that is actually routed through the proxy.\n\nIt is not a defense against:\n\nA malicious or already-compromised local process\n\nA client that bypasses the configured proxy\n\nExfiltration through an unrelated network channel\n\nSecret formats the detector does not recognize\n\nCredentials that were already exposed before Anonmyz was enabled\n\nIt is also not a replacement for least-privilege credentials, secret rotation, endpoint isolation, or a full agent sandbox.\n\nThe proxy is one enforceable boundary in a layered security model—not magic dust for every agent-security problem.\n\nSecurity work before promotion\n\nSecurity tools deserve more scrutiny than ordinary developer utilities. A bug in the guardrail can create a false sense of safety.\n\nDuring a static security review, several boundary problems were identified and fixed before the current release path:\n\nIDE integrations no longer automatically execute a binary found inside an untrusted workspace.\n\nCodex Safe Session routing and transport settings cannot be overridden by forwarded arguments.\n\nRemote plaintext HTTP upstreams are rejected.\n\nStream processing retains credential look-behind across chunk boundaries.\n\nStandard upstream responses have explicit size limits.\n\nNewly generated CA keys use salted PBKDF2-HMAC-SHA-256 with 210,000 iterations.\n\nThe project also keeps a public threat model and treats bypass reports as security issues rather than ordinary feature requests.\n\nThat does not mean the project is “proven secure.” It means its claims are deliberately scoped and its boundaries are meant to be testable.\n\nTry to break it\n\nThe most useful feedback for a project like this is not “nice work.” It is a reproducible bypass.\n\nIf you use an AI coding agent, you can help by:\n\nRunning Anonmyz with fake test credentials.\n\nInspecting what is actually sent to the upstream provider.\n\nTrying unusual JSON nesting, tool-result payloads, and streaming boundaries.\n\nReporting false positives or unsupported secret formats.\n\nTesting it with a client or provider adapter that is not covered yet.\n\nThe repository, setup instructions, threat model, and security policy are available here:\n\nIf the project solves a problem you have, a GitHub star helps other developers discover it. If it fails in your environment, an issue with a minimal reproduction is even more valuable.\n\nAI coding tools should not have to be banned simply because they can see local context. We should be able to place a measurable, local security boundary between that context and the cloud.", "url": "https://wpnews.pro/news/your-ai-coding-agent-can-read-env-heres-how-to-stop-secrets-before-they-reach", "canonical_source": "https://dev.to/3mre0s/your-ai-coding-agent-can-read-env-heres-how-to-stop-secrets-before-they-reach-the-cloud-4dg0", "published_at": "2026-08-18 14:50:30+00:00", "updated_at": "2026-08-18 15:15:13.907407+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools"], "entities": ["Anonmyz", "Claude Code", "Codex", "Cursor", "Aider", "Cline"], "alternates": {"html": "https://wpnews.pro/news/your-ai-coding-agent-can-read-env-heres-how-to-stop-secrets-before-they-reach", "markdown": "https://wpnews.pro/news/your-ai-coding-agent-can-read-env-heres-how-to-stop-secrets-before-they-reach.md", "text": "https://wpnews.pro/news/your-ai-coding-agent-can-read-env-heres-how-to-stop-secrets-before-they-reach.txt", "jsonld": "https://wpnews.pro/news/your-ai-coding-agent-can-read-env-heres-how-to-stop-secrets-before-they-reach.jsonld"}}