Your coding agent can read .env. Here's where the API keys should live instead.

I gave Claude Code shell access to a side project last spring and watched it debug a failing OpenAI call the way any of us would: it ran cat .env. The key was n