Your coding agent can read your .env. Here’s what we did about it

Description and use

penv protects secrets from leaking when AI coding agents run by separating the env schema from values, validating before execution, masking output, and auto‑generating harness‑specific guard rules.

Problem

Coding agents run in the same user context as developers, so they can read .env files and leak secrets through logs, transcripts, or stack traces.

Outcome

penv protects secrets from being read or leaked by coding agents by separating the schema from the values, validating before execution, masking output, and generating harness‑specific guard rules.

Workflow

• Run penv init to read the existing .env, generate .env.schema, and gitignore .env.
• Use penv run -- <command> to validate the environment, inject values, and mask any sensitive output when an agent session is detected.
• Generate typed accessors with penv gen ts or penv gen py to replace direct process.env usage.
• If using a team, run penv login and penv push to store secrets in penv.cloud and delete local .env.
• Use penv reveal KEY under an agent session to request a secret with human approval.

Evidence

penv init # reads .env, writes .env.schema, gitignores .env

Source

penv run -- pnpm dev # validates, injects, masks

Source

penv guard writes what each harness actually enforces

Source

penv keeps secrets out of the files, the repo, the shell history and the captured output an agent reads.

Source