--- title: How to protect secrets when coding agents deploy your app description: Coding agents can leak production secrets even when a database password never appears in Git or in the agent's context. An agent might copy a .env file into a... canonical: https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to protect secrets when coding agents deploy your app | daily.dev og:description: Coding agents can leak production secrets even when a database password never appears in Git or in the agent's context. An agent might copy a .env file into a... og:url: https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk og:image: https://api.daily.dev/og/posts/Npq9aPQLk.png og:image:alt: How to protect secrets when coding agents deploy your app og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to protect secrets when coding agents deploy your app **[Flavio Copes](https://daily.dev/sources/flaviocopes)** · 24 min read · 2 upvotes · 1 comments ## Summary Coding agents can leak production secrets even when a database password never appears in Git or in the agent's context. An agent might copy a .env file into a build, embed a private key in browser JavaScript, or deploy server code that reads an existing secret binding it never saw. The post maps exposure points across the workspace, process environment, CI, build output, and production runtime, then recommends isolated workspaces, development-only credentials, OIDC instead of long-lived deployment tokens, Gitleaks scans (gitleaks git and gitleaks dir) on both Git history and build output, and separating the build job from a narrow publisher that holds the deployment credential. It also warns that Cloudflare Worker secrets can be disclosed by any code deployed with access to that binding, since the runtime, not the deploy API, exposes the value. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can an AI coding agent leak a secret even if it never sees the secret's value? An agent can deploy server code that reads an existing production secret binding at runtime without ever knowing its value beforehand. For example, with Cloudflare Worker secrets, values are hidden in the dashboard and Wrangler, but Worker code receives them at runtime, so someone who can deploy replacement code can make it read and disclose that binding. _Developers hardening agent-driven deploy pipelines can track practices like this on daily.dev._ ### How do I scan both my git history and build output for leaked secrets with Gitleaks? Run 'gitleaks git --redact=100 --no-banner .' to check git history, and 'gitleaks dir --redact=100 --no-banner dist' to check the output directory, including generated files that were never committed. Gitleaks returns a nonzero status on finding leaks by default, so CI should be configured to fail on a finding rather than treated as a warning with '|| true' or 'continue-on-error'. _Teams wiring secret scanning into CI can keep up with tooling like Gitleaks via daily.dev._ ### Why should I use OpenID Connect instead of a long-lived deployment token in GitHub Actions? GitHub Actions supports OpenID Connect to exchange a job's identity token for temporary credentials from a compatible provider, avoiding storage of a long-lived cloud credential in repository CI secrets. The trust policy must restrict the accepted issuer, audience, and subject claims, since a policy trusting every branch or repository defeats the benefit, and a short-lived credential can still cause damage during its active window. _Developers deciding between deploy token strategies can follow OIDC and CI security practices on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@kartiknvj** · 0 upvotes > I've leaned on the file tool's deny list and never pointed the shell tool at the same boundary. Dropping a harmless marker outside the project and asking both tools to read it is quick enough that I'd rerun it every time I add a tool to the agent, since each new tool is another path to that file. ## Similar posts on daily.dev - [Protecting Developers Means Protecting Their Secrets](https://daily.dev/posts/protecting-developers-means-protecting-their-secrets-3i6xn3xnm) · Security Boulevard · 0 upvotes · 0 comments - [Local Guardrails for Secrets Security in the Age of AI Coding Assistants](https://daily.dev/posts/local-guardrails-for-secrets-security-in-the-age-of-ai-coding-assistants-xgxgddqse) · GitGuardian · 0 upvotes · 0 comments - [\[REDACTED\] — How to keep your mobile app’s secrets, a secret\!](https://daily.dev/posts/redacted-how-to-keep-your-mobile-app-s-secrets-a-secret--605z53tt1) · ProAndroidDev · 0 upvotes · 0 comments - [Stop Putting Secrets in .env Files](https://daily.dev/posts/stop-putting-secrets-in-env-files-yml3clr0r) · Lobsters · 2 upvotes · 0 comments - [Preventing secret leakage in CI/CD environments](https://daily.dev/posts/preventing-secret-leakage-in-ci-cd-environments-tveiielvq) · Security Boulevard · 2 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#cicd](https://daily.dev/tags/cicd), [#appsec](https://daily.dev/tags/appsec), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to protect secrets when coding agents deploy your app","url":"https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk"},"datePublished":"2026-10-27T08:20:24.285Z","dateModified":"2026-10-27T08:20:54.755Z","description":"Coding agents can leak production secrets even when a database password never appears in Git or in the agent's context. An agent might copy a .env file into a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dba282ff59a613d5edffa2d2ee289963?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dba282ff59a613d5edffa2d2ee289963?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Flavio Copes","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Flavio Copes","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1f2dbd275797411bbd37bfdaaf0951a9","url":"https://daily.dev/sources/flaviocopes"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"ai-agents,cicd,appsec,prompt-injection,secrets-management","timeRequired":"PT24M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Flavio Copes","item":"https://daily.dev/sources/flaviocopes"},{"@type":"ListItem","position":3,"name":"How to protect secrets when coding agents deploy your app"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk","comment":[{"@type":"Comment","text":"I’ve leaned on the file tool’s deny list and never pointed the shell tool at the same boundary. Dropping a harmless marker outside the project and asking both tools to read it is quick enough that I’d rerun it every time I add a tool to the agent, since each new tool is another path to that file.","datePublished":"2026-10-28T13:53:52.342Z","url":"https://daily.dev/posts/Npq9aPQLk#c-Lr6aYPPke","author":{"@type":"Person","name":"kartik-nvjk","url":"https://daily.dev/kartiknvj","image":"https://media.daily.dev/image/upload/s--3gGgsVCw--/f_auto/v1781456774/avatars/avatar_TvTVeiMdkRCqWUDullFmy?_a=BAMAMiWQ0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-protect-secrets-when-coding-agents-deploy-your-app-npq9apqlk#faq","mainEntity":[{"@type":"Question","name":"How can an AI coding agent leak a secret even if it never sees the secret's value?","acceptedAnswer":{"@type":"Answer","text":"An agent can deploy server code that reads an existing production secret binding at runtime without ever knowing its value beforehand. For example, with Cloudflare Worker secrets, values are hidden in the dashboard and Wrangler, but Worker code receives them at runtime, so someone who can deploy replacement code can make it read and disclose that binding. Developers hardening agent-driven deploy pipelines can track practices like this on daily.dev."}},{"@type":"Question","name":"How do I scan both my git history and build output for leaked secrets with Gitleaks?","acceptedAnswer":{"@type":"Answer","text":"Run 'gitleaks git --redact=100 --no-banner .' to check git history, and 'gitleaks dir --redact=100 --no-banner dist' to check the output directory, including generated files that were never committed. Gitleaks returns a nonzero status on finding leaks by default, so CI should be configured to fail on a finding rather than treated as a warning with '|| true' or 'continue-on-error'. Teams wiring secret scanning into CI can keep up with tooling like Gitleaks via daily.dev."}},{"@type":"Question","name":"Why should I use OpenID Connect instead of a long-lived deployment token in GitHub Actions?","acceptedAnswer":{"@type":"Answer","text":"GitHub Actions supports OpenID Connect to exchange a job's identity token for temporary credentials from a compatible provider, avoiding storage of a long-lived cloud credential in repository CI secrets. The trust policy must restrict the accepted issuer, audience, and subject claims, since a policy trusting every branch or repository defeats the benefit, and a short-lived credential can still cause damage during its active window. Developers deciding between deploy token strategies can follow OIDC and CI security practices on daily.dev."}}]} ```