The framing helps: an agent that can read files, run commands and commit is a different exposure than autocomplete. A .env that was harmless in a project folder stops being harmless once something can read it and commit. How do you check afterwards that nothing sensitive got into a commit?