A coding agent in a repository with secrets

A coding agent needs enough context to make useful changes. It rarely needs the credentials that make those changes work in production. The difficult part is separating those two needs when files, shell commands, test failures, and tool responses can all become model input.

Use the following decisions before opening a repository in Claude Code, Codex, Gemini CLI, or another coding agent. The goal is not merely to keep secrets out of Git. It is to keep them out of everything the agent can read or receive.

§ Does the task require a real secret?

If the task is editing code, start without credentials. Most refactors, interface changes, and unit tests can use fixtures, mock services, or clearly fake values. Provide an example configuration containing variable names and placeholders, not a copy of a working environment file.

If the task requires an integration test, separate writing the test from running it with credentials. Let the agent produce the change, then execute the credentialed step through a controlled process that returns a narrow result.

• Use synthetic records instead of customer exports.
• Use restricted test accounts instead of production identities.
• Return pass status and sanitized diagnostics instead of complete request traces.

Decision criterion: if a fake value preserves the behavior being tested, a real credential does not belong in the agent’s workspace.

§ Can the agent reach the secret indirectly?

A secret outside the repository can still enter context. Agents may read home-directory configuration, inspect inherited environment variables, execute scripts, or receive logs containing authorization headers. A failed command can expose more than a successful one.

Repository ignore files are not security boundaries. Git exclusions govern version control; agent-specific exclusions may limit some discovery paths but should not be assumed to block shell access or every tool.

Choose isolation when access is unnecessary. Use a sandbox or container with only the required working directory mounted. Avoid mounting credential directories, SSH agents, cloud configuration, or unrelated projects. Restrict network access where practical, and verify the actual permissions of the agent’s shell and tools.

Test the boundary with a harmless marker file, not a real secret. Check whether the agent can read it directly or retrieve it through another tool.

§ Does authentication need to pass through the model?

Usually, no. An agent client may need an API key to authenticate its model requests, but the model does not need that key in a prompt, repository instruction, or debugging transcript.

For Vana API, configure the client’s authentication and endpoint through its supported settings. Vana API provides one OpenAI-compatible endpoint and also supports Anthropic Messages and Gemini native protocols. That compatibility helps connect existing tools; it does not make local credential handling safe automatically.

Keep credentials in the client’s transport configuration, not its conversational context. If the agent’s shell inherits the same key, the separation is incomplete. Prefer a launch setup or credential broker that supplies authentication without exposing it to agent-executed commands.

If you need a compatible endpoint for this setup, create a Vana API account and configure the client outside the repository.

§ What information will tools return?

Treat tool output as an explicit disclosure channel. Database clients, HTTP debuggers, deployment commands, and test runners can print credentials or sensitive records even when the agent never opens a secret file.

Prefer tools that return only approved fields. Suppress authorization headers, cookies, connection strings, and unnecessary payloads before output reaches the agent. Pattern-based redaction is a backup, not a guarantee: secrets can have unexpected formats or appear inside encoded content.

Decision criterion: if you cannot predict and constrain a tool’s output, run that step outside the agent session.

§ Has a secret already entered context?

Stop the workflow and revoke or rotate the credential. Deleting a local message does not establish that copies disappeared from transcripts, logs, or downstream systems. Follow the relevant services’ retention and incident procedures.

Then identify the disclosure path and close it before restarting. A smaller workspace, narrower tool response, or separate credentialed runner is more dependable than asking the agent not to reveal a secret it can already read.