---
title: "Discussion on \"Keep secrets out of reach of your coding agent\" | Hashnode"
description: "Discussion on \"Keep secrets out of reach of your coding agent\". Coding agents that run in a terminal can read files, run commands and commit code. That is the point of them, and it is also why they change where secrets are exposed. A .env file that was a harmless"
url: "https://hashnode.com/posts/keep-secrets-out-of-reach-of-your-coding-agent/6af5c6f7a6f3a54a11a22c8e"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Keep secrets out of reach of your coding agent](https://resahost.hashnode.dev/keep-secrets-out-of-reach-of-your-coding-agent?utm_source=hashnode&utm_medium=feed)

Coding agents that run in a terminal can read files, run commands and commit code. That is the point of them, and it is also why they change where secrets are exposed. A .env file that was a harmless

1d ago · 6 min read · resahost.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#ai](https://hashnode.com/tag/ai)
-   [#devops](https://hashnode.com/tag/devops)
-   [#git](https://hashnode.com/tag/git)

## Written by

[Olli Junes](https://hashnode.com/@resahost)

@resahost

  
[View profile](https://hashnode.com/@resahost)

## Responses 1

Markdown supported · ⌘↵ to post

[Paul Pham](https://hashnode.com/@paulpham157)

[21h ago](https://hashnode.com/posts/keep-secrets-out-of-reach-of-your-coding-agent/6af5c6f7a6f3a54a11a22c8e/comment/6af60b42cfae898e2860492b)

The framing helps: an agent that can read files, run commands and commit is a different exposure than autocomplete. A .env that was harmless in a project folder stops being harmless once something can read it and commit. How do you check afterwards that nothing sensitive got into a commit?