secret-handling

Preventing AI agents from leaking secrets requires forbidding them from reading live environment files. This approach enforces safe alternatives like .env.example and applies pre-commit validation to block credentials from entering committed files.

Pre-commit validation stops credential exposure by scanning staged files for secret patterns before they are committed. It blocks commits containing credentials and provides remediation guidance for any secrets accidentally committed to the repository.

The best way to manage env files safely during onboarding is to consult .env.example for the schema and never read live secret files. You should prompt users for values and replace secrets with placeholders before committing.

Yes, you can use .env.example as a safe alternative to .env files for automation. It provides the necessary schema without exposing live secrets, allowing agents to understand configuration structures while maintaining credential security.

If secrets are accidentally committed to a squad workspace, you should follow established remediation guidance to remove them. Pre-commit validation is designed to block these commits, but remediation steps exist to handle accidental credential leakage.