How to Keep Your .env Files Safe from AI Coding Agents

If you use Claude Code or any AI coding agent, your .env file is one cat .env away from being read into the context window. Once it is in the context, your API keys, database passwords, and secrets are part of the conversation.

This is not hypothetical. AI agents routinely read files to understand your project. A helpful agent trying to debug a database connection issue will naturally want to check the connection string.

.claudeignore

The simplest protection is a .claudeignore file in your project root:

.env
.env.*
*.pem
*.key
credentials.json
service-account.json

This tells Claude Code to never read these files, even if it wants to. The agent can still know these files exist, but it cannot access their contents.

macOS Keychain for Desktop Agents

For desktop automation agents like Fazm, the macOS Keychain is a better approach than environment variables entirely.

Instead of storing secrets in files:

# Store a secret
security add-generic-password -s "openai-api-key" -a "fazm" -w "sk-..."

# Retrieve it programmatically
security find-generic-password -s "openai-api-key" -a "fazm" -w

The agent can request a specific secret by name without ever seeing the rest of your keychain. The secret never touches the filesystem. It goes from the Keychain directly into memory, gets used for the API call, and is discarded.

The Principle

The rule is simple: secrets should never be in a file that an AI agent can read. Use .claudeignore for file-based secrets and the Keychain for runtime secrets.

This is especially important for local-first agents that have deep access to your machine. The privacy benefit of local processing is undermined if the agent can read your API keys from dotfiles.

---

Fazm uses macOS Keychain for all secret management. Open source on GitHub. Discussed in r/ClaudeAI.