Stop Storing LLM API Keys in Plaintext `.env` Files — Introducing LLM Key Ring (`lkr`)

TL;DR Storing LLM API keys in .env files carries risks that have become harder to ignore in the age of AI agents. I built LLM Key Ring ( lkr ) — a CLI tool written in Rust that stores keys in the macOS Keychain with encryption. Keychain storage — no plaintext files left on disk lkr exec for env var injection — keys never touch stdout, files, or clipboard; this is the primary workflow TTY guard — blocks raw key output in non-interactive environments (defense against AI agent exfiltration) https://github.com/yottayoshida/llm-key-ring Motivation: “It’s in .gitignore , so it’s fine” No Longer Holds Working with LLMs means API keys pile up fast — five, ten of them sitting in a .env file before you know it. # .env OPENAI_API_KEY=sk-proj-... ANTHROPIC_API_KEY=sk-ant-... The problem is simple: once plaintext lives “somewhere,” the attack surface expands. Accidental commits ( .gitignore is only as reliable as human discipline) Keys leaking into shell history, command-line arguments, or logs If