Keep agents from reading .env files and committing secrets

Symptoms

• API keys show up in commits or agent logs
• A provider notifies you of a leaked key

Common causes

• Secrets live in plain text in the project’s .env and the agent can read it
• There is no pre-commit scanning

How to fix

1. Use the client’s deny rules to block reading .env, key files and credential directories
2. Keep secrets in a secrets manager (e.g. Vault, Infisical) and inject them at run time instead of storing them in the repo
3. Add pre-commit scanning, e.g. gitleaks git or gitleaks protect (check your version’s docs), and scan again in CI
4. Revoke and regenerate leaked keys at the provider immediately; deleting the commit is not enough
5. Scan the full history with trufflehog to make sure nothing else slipped through