secret-handling

To prevent environment secrets from being leaked, you must prohibit code agents from reading live .env files entirely. This approach enforces safe alternatives, ensuring credentials are never exposed or committed during automated repository operations.

The safe alternative to reading live environment variables is inspecting .env.example, .env.sample, or .env.template files. These files provide the required configuration schema without exposing actual secret values to code agents.

Managing credential leakage risks in a CI/CD environment requires enforcing security policies that block agents from reading sensitive files. This ensures secrets are not leaked through automated decisions, logs, or code generation workflows.

Yes, you can use documentation and prompt-based queries to understand required environment variables. This method enforces safe credential management by prescribing documented sources over accessing live secret files.

Yes, this approach applies to all variations of environment files including .env.local, .env.production, .env.development, .env.staging, and .env.test. It implements explicit prohibitions on reading any sensitive environment file.

Spawned agents should not read live repository credentials because they have broad read access, which risks exposing sensitive data. Prohibiting access to .env files and enforcing policy alternatives prevents credential leakage.