---
title: "Comment by Paul Pham on \"Keep secrets out of reach of your coding agent\" | Hashnode"
description: "The framing helps: an agent that can read files, run commands and commit is a different exposure than autocomplete. A .env that was harmless in a project folder"
url: "https://hashnode.com/posts/keep-secrets-out-of-reach-of-your-coding-agent/6af5c6f7a6f3a54a11a22c8e/comment/6af60b42cfae898e2860492b"
---

[Discussion](https://hashnode.com/posts/keep-secrets-out-of-reach-of-your-coding-agent/6af5c6f7a6f3a54a11a22c8e)

Comment [Keep secrets out of reach of your coding agent](https://hashnode.com/posts/keep-secrets-out-of-reach-of-your-coding-agent/6af5c6f7a6f3a54a11a22c8e)

[Paul Pham](https://hashnode.com/@paulpham157)

[21h ago](https://hashnode.com/posts/keep-secrets-out-of-reach-of-your-coding-agent/6af5c6f7a6f3a54a11a22c8e/comment/6af60b42cfae898e2860492b)

The framing helps: an agent that can read files, run commands and commit is a different exposure than autocomplete. A .env that was harmless in a project folder stops being harmless once something can read it and commit. How do you check afterwards that nothing sensitive got into a commit?