secret-handling

To prevent secret leakage into git commits, use pre-commit validation to scan staged changes for credentials and configure agents to read from .env.example files instead of live environment files.

The best way to stop agents from reading live credentials is to prohibit access to .env files and prompt for secrets directly, ensuring agents only read .env.example for the required schema.

Pre-commit secret scanning works by checking staged changes before they are finalized, automatically blocking git commits that contain exposed credentials to maintain safe practices and prevent leakage.

Yes, you can use .env.example files to share the environment variable schema safely, allowing team collaboration without exposing live credentials during repository automation workflows.

You should redact secrets to ensure access control and safe handling, preventing credential leakage when automated agents generate decisions and logs that might otherwise expose sensitive data.