How to keep secrets away from AI coding agents
Claude Code, Cursor and similar agents can read any file in your project, including .env, and anything they print can end up in a transcript. Give them a command to run, not the secret.
The problem
An agent that can read your working directory can read your .env. Even when it does not mean to, a verbose flag, a stack trace or a casual echo of an environment variable puts the value into the conversation.
Once a secret is in a transcript or a log it is out of your control, and the only fix is to rotate it.
How to do it with SnapEnv
Stop writing secrets to disk
Instead of pulling to a .env file, run your command through snapenv run. Values are injected into the child process only.
snapenv run --env dev --only DATABASE_URL -- node server.js
Expose only what the command needs
Scope is explicit: --only for named keys or --all with optional --except. Running without a scope is an error, so a forgotten flag cannot silently expose everything.
Use placeholders where a literal is required
For tools like curl, write a {{VAR}} placeholder in the arguments. It is resolved just before the command starts, and an unknown key stops the command from running.
snapenv run --only API_TOKEN -- curl -H "Authorization: Bearer {{API_TOKEN}}" https://api.example.comLet the output scrubbing catch accidents
Anything the command prints to stdout or stderr is scanned as it streams, and exposed values are replaced with ***.
Teach the agent the workflow
Install the SnapEnv skill so Claude Code and other agents use these commands by default.
curl -fsSL https://get.snapenv.io/skill.sh | sh
Frequently asked questions
Is snapenv run a sandbox?
No. It reduces honest mistakes such as verbose logs or a careless echo. It does not stop a program that is deliberately trying to exfiltrate its own environment.
Does the agent still need a token?
The token authenticates the CLI. Scope it to a project and environment, and keep it out of the agent's reach, for example in your shell environment rather than a file in the repo.
Are short values scrubbed?
Values shorter than 6 characters are not scrubbed, because they would collide with unrelated output such as PORT=3000.
Free for small teams. Set up in minutes.
3 projects, 3 members, full CLI and Kubernetes operator. No credit card.