Secrets, Agents, and .env Files

Your .env file has your database credentials in it. Your Stripe key. Your AWS secret. Maybe a JWT signing key you generated at 2am and never rotated. Your AI agent can see all of it. When you give an agentic coding tool access to your project directory, it can read every file in that directory. That includes .env , .env.local , .env.production , and whatever other secrets files you've got sitting in the root of your project. The agent doesn't know those are sensitive. It just sees files. And if you ask it to "clean up the project structure" or "fix the config," there's nothing stopping it from including those files in a commit. One git add . and your secrets are in version history. Even if you delete the file in the next commit, they're still there. Permanently. Unless you rewrite history, and if you don't know how to do that, you probably won't. This is preventable. Let's prevent it. Layer 1: .gitignore This is the bare minimum. If you don't have a .gitignore that covers your secrets