secret-handling

Prevent secret exposure by enforcing rules that prohibit code agents from reading .env files and writing secrets to committed files. This skill blocks access to live credentials and provides safe alternatives like .env.example for configuration schemas.

Enforce secret handling by applying pre-commit validation guardrails that scan staged changes for secrets and block risky commits. This codifies prohibitions on reading sensitive files and prevents credentials from leaking into the repository history.

Yes, .env.example and .env.sample files serve as safe alternatives to store configuration schemas without exposing live credentials. This approach enforces secure credential handling by prompting users for secrets when needed instead of reading .env files.

Your security policy needs to block reading live .env files because spawned agents have read access to the repository, including files containing live credentials. Codifying these prohibitions prevents accidental credential leakage and enforces safe handling practices.

Yes, pre-commit validation works by scanning staged changes for secrets and blocking risky commits before they enter the repository. This guardrail enforces rules against writing secrets to committed files and prevents accidental credential exposure.

The limitation of relying on .env.example is that it only provides a configuration schema without live credentials, requiring users to be prompted for secrets when needed. You must still enforce pre-commit validations to block any actual secrets from being committed.