How do I keep secrets safe when using AI coding agents?

Reviewed answer

An agent can read and run whatever you can. Keep keys out of reach and check commands first.

Start the agent inside one project folder, never your home folder.
Keep live keys out of files the agent can read. Use test keys in .env files and store real ones in your system's password or secret store.
Read each command before approving it, especially ones that install packages, use the network, or delete files.
Treat web pages, issues, and repos the agent reads as untrusted. They can contain hidden instructions.
If a key ever appeared in a chat, log, or commit, revoke it and make a new one.

Get help if

If an agent ran a command you didn't expect or sent data somewhere unfamiliar, stop it, revoke any keys it could see, and check your cloud bills.