The Agent Could Still Open .env

Description and use

Coding agents can read git‑ignored secret files; logging every read and auditing against gitignore and secret patterns prevents accidental disclosure.

Problem

Coding agents can read git‑ignored secret files (e.g., .env) even when the prompt claims they won’t, because gitignore is not a sandbox and agents can access the filesystem directly.

Outcome

By logging every file read and validating tool outputs, teams can detect when a coding agent accesses git‑ignored secrets and take corrective action, preventing accidental disclosure.

Workflow

• 1. Enable a tool wrapper that logs each open/read operation to a JSONL trace file.
• 2. Run the coding agent in a disposable workspace (e.g., free server).
• 3. After the session, run a workspace audit script that compares logged paths against gitignore and secret‑name regexes.
• 4. Verify tool outputs by hashing stdout and comparing to the agent’s transcript.
• 5. If any secret file was read or tool output mismatches, investigate and remediate.
• 6. Clean up the workspace or start from a fresh clone to remove uncommitted secrets.

Evidence

git ignore rules only change which paths enter the index, the object database, and some porcelain listings.

Source

If the second command prints anything, the agent can print it under the same user.

Source