Agent reads your .env file into its context
Coding agents can read secrets files like any other file unless you deny it. Claude Code documents a Read deny rule for exactly this.
- Agents
- Claude Code
- Source checked
- Tags
- secrets, env, permissions
Symptom
API keys from .env appear in the agent's transcript, in a generated config, or in a log or commit.
Cause
File reads inside the working directory don't need approval by default, so a .env in the project is as readable as source code. Once it's in context, it can end up in any output.
Fix
Deny file tools access to secret files and keep real secrets out of the repo directory. Load them from a secret manager at runtime.
// .claude/settings.json
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(./.env.*)",
"Read(./secrets/**)"
]
}
}