The Defense — Make Secrets Unreadable, Not 'Private'

The only reliable defense is to never let the LLM see the secret in the first place. "Tell it not to share" is not a defense.

The layered strategy

Layer	What it does	How
1. Don't put secrets in files the agent reads	If it's not in context, it can't be repeated	Use OS keychain, secrets manager, or runtime env vars from outside the repo
2. Ignore-files	Belt-and-suspenders for #1	`.cursorignore`, `.aiignore`, `.aiderignore`, etc.
3. Use placeholders in committed configs	Real values exist only in the running process	`.env.example` with `API_KEY=<FROM_KEYCHAIN>`
4. Rotate aggressively	Limits blast radius if leaked	OPENAI / Anthropic / GitHub keys: rotate quarterly minimum
5. Scoped tokens	Even leaked tokens have small blast radius	Read-only DB users, repo-scoped GitHub PATs

Code

.cursorignore (and equivalents) — what to always list·text

# .cursorignore (and equivalents)
.env
.env.*
*.pem
*.key
*.crt
*.p12
secrets/
credentials/
config/secrets.*
*.sqlite          # may contain session tokens, password hashes
*.db
.ssh/
.aws/credentials
.gnupg/

The keychain pattern — fetch secrets at runtime·python

import keyring  # pip install keyring  -- backed by macOS Keychain / Windows Credential Vault / Secret Service

def get_api_key() -> str:
    key = keyring.get_password("my-app", "OPENAI_API_KEY")
    if not key:
        raise RuntimeError("Set with: keyring set my-app OPENAI_API_KEY")
    return key

# In committed code, only this function exists.
# The actual key was set once via CLI: keyring set my-app OPENAI_API_KEY

What goes in .env.example (and gets committed)·text

# Committed file. Real values come from keychain/keyring at runtime.
OPENAI_API_KEY=<set with: keyring set my-app OPENAI_API_KEY>
ANTHROPIC_API_KEY=<set with: keyring set my-app ANTHROPIC_API_KEY>
DB_PASSWORD=<set with: keyring set my-app DB_PASSWORD>

Exercise

On one of your projects today: (1) install keyring (pip install keyring); (2) keyring set <app> OPENAI_API_KEY for any keys currently in .env; (3) replace .env reads with a get_secret() helper that calls keyring; (4) replace .env values with <FROM_KEYCHAIN> placeholders; (5) add .env.* to your .cursorignore. The agent now sees structure, not secrets.

The Defense — Make Secrets Unreadable, Not 'Private'

The layered strategy

Code

External links

Exercise

Progress

Comments 0