The Agent Could Still Open .env

Описание и применение

Кодовые агенты могут читать git‑игнорируемые файлы‑секреты, поэтому необходимо логировать все операции чтения и проверять их против правил gitignore и шаблонов секретов.

Задача

Coding agents can read git‑ignored secret files (e.g., .env) even when the prompt claims they won’t, because gitignore is not a sandbox and agents can access the filesystem directly.

Результат

By logging every file read and validating tool outputs, teams can detect when a coding agent accesses git‑ignored secrets and take corrective action, preventing accidental disclosure.

Рабочий процесс

• 1. Enable a tool wrapper that logs each open/read operation to a JSONL trace file.
• 2. Run the coding agent in a disposable workspace (e.g., free server).
• 3. After the session, run a workspace audit script that compares logged paths against gitignore and secret‑name regexes.
• 4. Verify tool outputs by hashing stdout and comparing to the agent’s transcript.
• 5. If any secret file was read or tool output mismatches, investigate and remediate.
• 6. Clean up the workspace or start from a fresh clone to remove uncommitted secrets.

Доказательства

git ignore rules only change which paths enter the index, the object database, and some porcelain listings.

Источник

If the second command prints anything, the agent can print it under the same user.

Источник