.env files and AI coding agents
.env files were designed to keep keys out of source control, not out of software running in your project. An AI coding agent reads files to understand your code, and a .env file is just another file.
How keys in .env files leak to agents
- Context. The agent opens the file, or a tool output that prints it, and the key becomes part of the conversation sent to the model provider.
- Logs and transcripts. Agent sessions are often saved to disk, and keys go with them.
- Commands. An agent debugging a request may echo the key, paste it into a curl command or write it into a test.
- Prompt injection. A web page, issue or file the agent reads can tell it to send your secrets somewhere.
.gitignore doesn't help with any of these: the file is still on disk, in the folder the agent works in.
Find the keys you already have
LLLanyard can find plaintext keys in .env files, MCP and IDE configs and shell profiles. It's a dry run unless you ask it to change anything, and it never prints the full key:
lllanyard scan
Move them into the keychain
lllanyard scan --import --apply --redact
This stores each key in your OS keychain and replaces it in the file with a placeholder. The file is edited atomically, with no backup copy, since a backup would be one more plaintext copy. Treat any key that sat in a file an agent could read as exposed: create a new one at the provider and run lllanyard rotate.
Run your code without the file
Instead of loading .env, start the program through LLLanyard:
lllanyard exec python3 sync.py lllanyard exec --keys openai,stripe -- npm run dev
For a script, LLLanyard reads it and passes only the keys it uses. For a program that isn't a script, such as npm, name the keys with --keys. The keys exist only in that process's environment, for that run, and are redacted from its output.
Try it: LLLanyard is free for up to 10 keys.
npm install -g @lllanyard/cli lllanyard doctor