Why Your AI Coding Agent Should Never See Your .env

Your AI agent uses your API keys. It NEVER sees them. Not in context. Not in logs. Not in chat. Not even if it tries. You just gave your AI coding assistant a .env file with OPENAI_API_KEY=sk-..., GITHUB_TOKEN=ghp_..., maybe an AWS_SECRET. You trust it to use those keys. But here's the uncomfortable question nobody asks: Where does that key actually go?

The Problem (That Nobody Talks About)

One malicious webpage. One injected instruction buried in a doc your agent reads. Every credential - gone. AI agents are promiscuous with context. They log everything. They echo everything. They will happily print(env) if a prompt tells them to.

The Solution: Reference, Not Reveal

I built env-guard around a simple principle: the agent references a secret by name, and the OS expands it at execution time. The raw value is never in a place the model can read.

.env.list (NAMES ONLY)        live env (VALUES)
OPENAI_API_KEY ──refs──▶      OPENAI_API_KEY=sk-...
GITHUB_TOKEN                  GITHUB_TOKEN=ghp_...
       │ OS expands $NAME │
       secret-run.py (audited, no reveal)

The agent types:

curl -H "Authorization: Bearer $OPENAI_API_KEY" https://api.openai.com/v1/models

The shell expands $OPENAI_API_KEY. The model sees $OPENAI_API_KEY - never sk-....

How It Works

Three layers:

• .env.list - auto-generated index of variable names only (no values), via env-scan.py
• Live env - real values stay in the OS environment, never written to disk by the agent
• secret-run.py - runs the command with the variable in child env, logs model + provider + purpose, and refuses to echo the value

python scripts/secret-run.py \
  --var OPENAI_API_KEY \
  --model "gpt-4o" \
  --provider "openai" \
  --purpose "list models" \
  -- curl -s https://api.openai.com/v1/models

Unknown variables are refused. Every access is audit-logged with reveal: false. Even a direct cat .env instruction fails - the agent has no read access to the raw file.

Why This Matters

env-guard doesn't ask the agent to be careful. It makes carelessness impossible. The value is simply never in a place the model can read.

Works with Claude Code, Codex, Hermes, Cursor, OpenCode, Aider. MIT licensed. 👉 github.com/Z-150/env-guard - clone it, drop it in your skills/ folder, star it if it saved your keys. Built by Dext4r (Zaxs), powered by Nous Research:CAB.