Notes from a week of secret-free coding sessions

Coding agents are useful because they can read files, explain errors, edit code, and run commands. That access also creates a quiet security problem: anything you place in the agent’s context may be remembered in logs, copied into a file, included in a prompt, or exposed in a later session.

The safest habit is simple: let the agent work with instructions and references, while keeping secrets outside the context it can read.

§ What counts as a secret

A secret is any value that grants access or reveals information that should stay private. Common examples include API keys, database passwords, access tokens, private certificates, signing keys, and credentials stored in configuration files.

Private customer data can need the same care. Email addresses, support messages, internal URLs, and production records may not be credentials, but they still do not belong in a general coding prompt unless the task truly requires them.

§ Keep keys in the environment

Environment variables are a practical starting point. Store the value in your local shell or a secret manager, then let the application read it at runtime.

For example, an application can read VANA_API_KEY from its environment. The agent can help write the code that reads the variable without seeing the variable’s value. Your source code can then be shared, reviewed, and committed without carrying a live credential.

Do not paste the key into a prompt to ask whether the setup works. Ask the agent to inspect the variable name, the loading code, and the error handling instead. You can test the real request yourself or run a local command that reports only whether authentication succeeded.

§ Give the agent a narrow view

Before starting a session, decide which files the agent needs. A small bug in a web handler may require the handler, its tests, and a related type definition. It probably does not require the whole home directory, a production export, or every configuration file.

Use ignore files and workspace boundaries where your tool supports them. Keep secrets in files such as .env.local, and ensure those files are excluded from version control. A committed .gitignore entry helps, but it does not remove a key that was already committed. If a secret reaches a repository, revoke it and issue a replacement.

§ Use placeholders in examples

When asking for help, replace private values with clear placeholders such as YOUR_API_KEY, DATABASE_HOST, or REDACTED_CUSTOMER_ID. Keep the surrounding structure intact so the agent can still reason about the problem.

For a failing API request, share the method, endpoint shape, status code, and a redacted response. Remove authorization headers, cookies, full request bodies, and identifying customer data. If the exact value matters, explain its format rather than showing the value itself.

§ Be careful with command output

Agents often run shell commands and inspect their output. A command such as env, a verbose HTTP request, or a debug log can print credentials accidentally. Prefer commands that select one safe field or mask sensitive values.

Review generated logs before giving them to the agent. A token may appear in a URL, an exception message, a request header, or a tool transcript even when the source code looks clean.

§ Use a separate key for experiments

Development work should use a limited credential with a small budget and only the permissions it needs. Keep production credentials in a deployment system or secret manager. If an experimental key leaks, you can revoke it without interrupting the live service.

Vana API can be used through its OpenAI-compatible endpoint with Claude Code, Codex, Gemini CLI, and OpenAI SDK based tools. It also supports the Anthropic Messages and Gemini native protocols. Store the Vana API key in your environment and let your client read it at runtime; the model can then help with code while the key remains outside its prompt.

Vana API bills per real token without a monthly fee, and supports models such as Claude Sonnet 5.5 and Gemini 3.1 Pro. If you need a straightforward place to begin, create a Vana API account and set up a separate development key before opening your next coding agent session.