How to let an AI agent work in your repo without leaking your secrets

Coding agents now run with your shell. They read your files and run your build. They push commits under your name. That is the point of them. It also means every plaintext secret on your disk is reada