AI coding agents can silently read your .env secrets — here's how to limit exposure

AI coding assistants like Claude Code and Cursor automatically read all files in a project directory, including .env files containing sensitive credentials, without any explicit user prompt. Unlike traditional secret leakage via Git, this exposure happens entirely on-disk, bypassing protections like .gitignore. GitGuardian's 2026 report found over 24,000 secrets exposed through MCP configurations alone, highlighting how existing safeguards were not designed for AI agent workflows. Tools such as Doppler, Infisical, and API Drop address this by replacing plaintext secrets in config files with pointer references, resolving actual credentials only at runtime via an encrypted vault. The core principle is separating file-read access from secret access, ensuring an agent scanning project files never encounters a working credential in plaintext.