Why Your .env File Is the Most Dangerous File in Your AI Project

The .env file was a good idea for a different era. Load environment variables at startup, keep credentials out of source code, use .gitignore to prevent accidental commits. For a traditional web application running on a server you control, that is a reasonable security model. The application does what you wrote. The credentials sit where you put them. Nobody is sneaking instructions into the execution context through a product description. AI agents changed that completely. What changed A traditional application does exactly what you programmed it to do. It reads the .env file, stores the values in memory, and uses them where your code specifies. The attack surface is your code, and if your code is trustworthy, the credentials are safe. An AI agent processes external content. Webpages, documents, emails, API responses. Some of that content is written by people who know you are building agents and know what credentials your agent is likely to hold. The moment your agent processes a docu