The Agent Could Still Open .env

说明与用途

编码代理可能会读取被git忽略的秘密文件，因此需要记录所有读取操作并根据gitignore和秘密模式进行审计，以防止意外泄露。

问题

Coding agents can read git‑ignored secret files (e.g., .env) even when the prompt claims they won’t, because gitignore is not a sandbox and agents can access the filesystem directly.

结果

By logging every file read and validating tool outputs, teams can detect when a coding agent accesses git‑ignored secrets and take corrective action, preventing accidental disclosure.

工作流

• 1. Enable a tool wrapper that logs each open/read operation to a JSONL trace file.
• 2. Run the coding agent in a disposable workspace (e.g., free server).
• 3. After the session, run a workspace audit script that compares logged paths against gitignore and secret‑name regexes.
• 4. Verify tool outputs by hashing stdout and comparing to the agent’s transcript.
• 5. If any secret file was read or tool output mismatches, investigate and remediate.
• 6. Clean up the workspace or start from a fresh clone to remove uncommitted secrets.

证据

git ignore rules only change which paths enter the index, the object database, and some porcelain listings.

来源

If the second command prints anything, the agent can print it under the same user.

来源