Code, secrets and logs
What coding agents should see, and the secrets, customer data and logs they never should.
Start: Keep secrets outAbout this pack
Code, secrets and logs teaches what a coding agent should see and what it never should. Code is usually fine unless a contract restricts it. API keys, passwords, real customer data and production logs need walls. You'll set deny rules and exclusions in Claude Code, Cursor and Copilot, redact logs before you share them, handle a leaked key, and keep agents away from production credentials.
Best for: Developers and anyone who runs coding agents, including solo developers and contractors working in client code.
Good for
- Blocking agents from reading .env files and secrets folders
- Redacting tokens, cookies, emails and IP addresses from logs and stack traces
- Knowing the first steps after a secret is pushed or pasted
- Keeping secrets scoped in CI jobs and cloud agents
Where people slip
- Relying on a .claudeignore file. Claude Code ignores it, so use Read deny rules
- Forgetting that Cursor's terminal and MCP tools run outside .cursorignore
- Rewriting git history before you rotate the leaked key
- Running an agent in a shell that holds production credentials
How do I stop Claude Code from reading my .env file?
Add a deny rule to your permission settings, such as Read(./.env) or Read(./secrets/**). A deny rule in any scope beats an allow rule. A .claudeignore file has no effect. Run /permissions to see your rules.
What should I do if I committed an API key?
Revoke or rotate the key first. Then remove it from the code and the history. Rewriting history alone isn't enough, because old commits can remain in clones, forks and cached views.
Is it safe to paste logs into an AI tool?
Redact them first. Logs often hold auth headers, cookies, connection strings, emails and IP addresses. Swap them for labeled placeholders. Emails and IPs can identify people, so privacy law like GDPR can apply.
Does GitHub block secrets in a push?
Push protection blocks pushes that contain supported secret types. You can bypass it by giving a reason, but bypasses show in the security tab and audit log, and owners and security managers get an email.
Keep secrets out of context
Decide what a coding agent may read, and wall off .env files and keys before it starts.
0 of 2 lessons completeRedact logs and handle a leak
Strip secrets and personal data from logs before pasting, and rotate a leaked key in the right order.
0 of 2 lessons completeAgents near production
Keep agents away from production credentials and handle secrets safely in CI and cloud agents.
0 of 2 lessons complete