secret-handling

Prevent credential leakage by applying a security policy that bans agents from reading sensitive .env files and writing their contents into repository outputs. This avoids accidental exposure of live secrets in git history.

The best way to handle environment configuration safely is to ask the user directly for details and consult .env.example files for structure, rather than reading live secret files.

Blocking sensitive file reads prevents leaked credentials by stopping agents from accessing .env files. Since agents cannot read the secrets, they cannot write them into logs, decisions, or history files that get auto-committed to remote repositories.

Yes, .env.example, .env.sample, and .env.template files are safe alternatives. Agents can read these files to understand configuration structure without accessing live credentials.

You should use secret-handling policies whenever spawned agents have read access to a repository containing .env files. This prevents them from reading live credentials and auto-committing them to remote git history.