Published April 1, 2026·by Juan Isidoro·8 min read

Why .env Files Are Dangerous When You Code with AI

AI coding assistants read your .env files by default. Learn how secrets leak from environment files into context windows, logs, and commits, and what actually prevents it.

securityenv-filesai-agentsvibe-coding

GitGuardian's "State of Secrets Sprawl 2026" report, published March 17, 2026, found 28.65 million secrets exposed in public repositories. Among the findings: commits made with AI coding assistants leak secrets at a rate of 3.2%, roughly double the rate of human-only commits. The most common source is still the plaintext .env file sitting in your project root.

If you use Claude Code, Cursor, Windsurf, or any AI assistant with file system access, your .env is not as private as you think.

How AI Assistants Read Your Secrets

When you launch Claude Code in a project directory, it gains access to every file in the working tree. That includes .env, .env.local, .env.production, and any other file where you store API keys or database credentials.

The moment you ask Claude to "help set up the database connection" or "fix the Stripe integration," it reads your .env to understand the configuration. Your database password, your Stripe secret key, and your AWS credentials all enter the conversation context in plaintext.

This happens silently. No warning, no confirmation dialog. The AI reads the file because that is what you asked it to do: work with your project files.

Adding .env to .gitignore does nothing here. That prevents git from tracking the file, but the AI agent reads files directly from disk. The .gitignore file is irrelevant to an LLM that operates through a file system tool.

Knostic's research demonstrated something worse: even if a developer is careful, prompt injection in project configuration files (like CLAUDE.md or README.md) can instruct the agent to read .env and exfiltrate those values without the developer noticing. The attack surface is not just accidental reads. It is deliberate extraction.

Real Incidents

This is not a theoretical risk. Multiple documented cases show the problem in practice.

CVE-2025-55284: DNS exfiltration via Claude Code. Security researchers at Knostic discovered that malicious instructions embedded in a repository's CLAUDE.md file could cause Claude Code to exfiltrate environment variables through DNS queries. The attack worked by encoding secret values as subdomains in DNS lookups, bypassing any content filtering on the conversation itself. Anthropic patched this specific vector, but the vulnerability illustrates a fundamental problem: any agent with shell access can move data through side channels.

The Register investigation (January 2026). A detailed investigation documented how AI coding assistants including Claude Code, Cursor, and Windsurf routinely read .env files and expose credentials in context windows and log files. The article demonstrated that secrets entered the AI's working memory as a normal part of operation, not as an edge case.

GitHub community reports. Issues #8031 and #9637 on the Claude Code repository document real developers raising concerns about .env file exposure. These are not security researchers running contrived experiments. They are working developers who noticed their credentials showing up where they should not.

24,008 secrets in .mcp.json files. A researcher scanning public GitHub repositories found over 24,000 secrets hardcoded directly in .mcp.json configuration files. Developers who set up MCP servers with inline API keys and then committed the file created a new category of secret sprawl that did not exist before AI tooling.

Where Leaked Secrets End Up

Once a secret enters the AI's context window, it can travel to several places:

Chat history and logs. Your conversation is stored on the provider's servers. If your .env content was part of that conversation, it now lives in their infrastructure. Claude Code also writes session data to ~/.claude/ on your local machine.

Code suggestions. The AI might include your actual database URL in a code example instead of a placeholder. If you accept the suggestion without checking, the real value ends up committed to your repository.

Terminal output. If Claude runs a command that prints environment variables (like env, printenv, or docker inspect), those values appear in the conversation log and potentially in any telemetry.

Commits and pull requests. AI-generated code and commit messages sometimes include context from the session. A database connection string or API key can slip into a diff that gets pushed to a public repository.

The Problem Is Structural

This is not a bug in Claude Code, Cursor, or any specific tool. It is a consequence of how AI coding assistants are designed: they need file access to be useful, and .env files are designed to be human-readable plaintext.

OWASP recognized this pattern in their "Top 10 Risks for AI Agents & Agentic Applications," which lists "Secret & Credential Theft" as a specific risk category. The organization's assessment confirms that this is an industry-wide architectural issue, not a vendor-specific flaw.

Common workarounds fail for predictable reasons:

Telling the AI to ignore .env files. Prompt-level instructions can be overridden by context, by tool behavior, or by prompt injection in project files. This is not reliable.
Using environment variables only at runtime. Better in theory, but does not help when the AI needs to run your application locally during development.
Encrypting the .env file. Adds friction for every developer on the team and solves nothing if the AI has access to the decryption key or if the decrypted values end up in memory anyway.
Relying on .gitignore alone. Protects against git tracking. Does nothing against an AI agent reading from the file system.

These approaches try to solve an architectural problem with behavioral patches. The architecture itself needs to change.

What Actually Works

The solution is to prevent secret values from entering the AI's context window in the first place. This is the zero-knowledge inject pattern: the AI knows a secret exists and can use it in commands, but never sees the actual value.

AI requests STRIPE_KEY
  -> Fetch encrypted value from vault
  -> Write to temporary file on disk (owner-only permissions)
  -> Return to AI: "STRIPE_KEY injected -> /tmp/session/a1b2c3.env"
  -> AI runs: source /tmp/session/a1b2c3.env && npm run deploy

The AI's context window shows "STRIPE_KEY injected -> /path" instead of sk_live_abc123. Your chat history, logs, and any telemetry contain only the file path reference, never the raw secret.

This is what SecureCode calls "inject mode." The MCP server handles encryption, file writing, and cleanup automatically. The secret file uses restrictive permissions (owner-only read), gets overwritten on each new inject, and is deleted when you end your session.

The key insight is that the AI does not need to know your secret to use it. It just needs to know where the value is so it can reference it in shell commands.

A Practical Checklist

Whether or not you use a vault, here is what you can do today to reduce your exposure:

1. Block .env access in Claude Code settings. The correct mechanism is permissions.deny in your settings.json (located at ~/.claude/settings.json), not .claudeignore:

{
  "permissions": {
    "deny": ["Read(.env)", "Read(.env.*)", "Read(.securecoderc)"]
  }
}

This prevents Claude Code from reading those files regardless of what any prompt or project file instructs it to do.

2. Never paste secrets in the chat window. Even if the AI asks for a value to debug a connection issue, do not paste it. Use a file reference or environment variable instead.

3. Review AI-generated commits before pushing. Search diffs for common secret patterns: sk_, pk_, ghp_, AKIA, xoxb-, Bearer , connection strings with passwords.

4. Use a pre-commit hook. Tools like gitleaks or git-secrets scan staged changes and block commits that contain secret patterns. This is your last line of defense before secrets reach the repository.

5. Rotate any key that has appeared in a chat session. Even if you deleted the message, the value may exist in logs, backups, or provider infrastructure. Treat any exposed secret as compromised.

6. Audit your .mcp.json files. If you have MCP server configurations with inline API keys, move those values to environment variables or a vault. Never commit .mcp.json files with secrets.

For a complete setup that handles all of this automatically, managing secrets safely with Claude Code walks through the full workflow.

The Bigger Picture

The .env file was designed for a world where only humans and CI servers accessed project files. That world no longer exists. Every file in your project directory is now potentially visible to an AI model with full file system access and the ability to execute shell commands.

AI coding assistants make developers faster. That is not changing. What needs to change is the assumption that plaintext files in your project root are "local only." They are not. They are one prompt injection, one careless read, or one auto-indexing step away from being part of a conversation that lives on remote servers.

The industry is moving toward zero-knowledge patterns where AI agents can use secrets without seeing them. The sooner your workflow adopts that model, the fewer credentials you will need to rotate after an incident.