env-guard Tool Keeps API Keys Hidden from AI Coding Agents at Runtime

·1 views

A developer named Dext4r (Zaxs) has released an open-source tool called env-guard, designed to prevent AI coding assistants from ever accessing raw API key values. The tool works by exposing only variable names to the AI agent, while actual secret values remain in the OS environment and are expanded by the shell at execution time. A dedicated script called secret-run.py handles command execution, logs each access with a 'reveal: false' flag, and refuses to echo or expose secret values under any circumstance. The system is intended to guard against prompt injection attacks, where a malicious instruction could trick an agent into printing or leaking credentials. env-guard is MIT licensed, available on GitHub, and compatible with popular AI coding tools including Claude Code, Cursor, and Aider.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Self-Taught Developer Shares 6 Guardrails for Safer AI-Assisted Coding with Codex

A self-taught web developer who works as a truck driver published a guide on using OpenAI's Codex responsibly within VS Code for a personal Python-Flask application. He argues that the key difference in AI-assisted coding lies not in avoiding AI, but in clearly defining its scope, boundaries, and stopping points before assigning any task. His six guardrails include limiting each task to a single focused change, requiring Codex to report out-of-scope issues rather than fix them automatically, and writing pytest tests before modifying production code. He also isolates test environments by using in-memory SQLite databases for routine tests and separate PostgreSQL instances only for migration-specific checks. The approach, originally published in Japanese on Qiita, aims to keep AI changes traceable and prevent the application from silently reverting to unsafe states.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python Tutorial Shows How to Track Full Football Odds Movement History

A developer tutorial published on DEV Community demonstrates how to build a football odds-movement tracker in Python using tick-by-tick historical price data. Unlike most sports data APIs that only provide current odds snapshots, the approach captures every price change from when a bookmaker opens a line to the final whistle. The tutorial uses 5DollarFootballAPI, which stores complete tick histories dating back to 2014, including corner and card markets rarely covered elsewhere. The guide walks through fetching fixture data, retrieving odds snapshots, and then pulling full price histories to analyse pre-match market movement. The author notes the underlying technique works with any API that serves historical price data, and that full tick-history access requires a $25-per-month subscription tier.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Breaking Functions Into Smaller Parts Makes Code Easier to Reuse

A software developer argues that the most common problem in messy codebases is functions that try to do too much, rather than poor naming or missing comments. The solution, they propose, is designing small, composable functions where each unit handles a single transformation and passes its output to the next. Pure functions — those with no side effects and consistent outputs — are highlighted as the ideal building blocks, while side-effect-heavy functions like data fetching should be kept at the edges of a system. The article also introduces a 'pipe' helper pattern that chains multiple functions together, making it easy to add or remove transformation steps without rewriting logic. This approach, the developer contends, shifts the mindset from solving one-off problems to building a reusable toolbox of reliable, testable components.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Decision Anchor Aims to Lock Down AI Decision Records Before Rules Are Written

In July, historian Yuval Noah Harari argued that AI should be classified as an agent rather than a tool, since it can make autonomous decisions and generate novel outputs. He called for stronger safety investment, better alignment, and regulatory control over AI's development pace. Against this backdrop, a project called Decision Anchor is working to establish a technical standard for how decisions are recorded before they are executed — capturing what was agreed, by whom, and within what boundaries. The system is designed to store these records in a tamper-proof way without analyzing or judging their content, deliberately avoiding any predictive or interpretive role. Decision Anchor's founders argue that settling the format of decision records now, before broader AI governance frameworks solidify, is critical to preventing any single entity from controlling how such records are defined.

0 comments Read more at DEV Community