7 Lessons From Securing my Project’s Secrets

Do you have your secrets (e.g., API keys) stored in a .env file in your computer?

BE CAREFUL!

Your AI agents are able to read them even if you are cautious enough not to paste them directly into the AI chat.

This means that, if your agents have ever read your secrets—which has likely happened at some point—an attacker that steals your chat transcripts can get the raw secrets, allowing them to steal data or run up your costs without you even noticing.

That said, there is an easy first step that you can take toward securing these values:

I recently discovered a tool called Automic Vault by Max Howell, the creator of Homebrew, which is exactly for this. If you are a Mac user, you can download it from GitHub.

The process is simple yet powerful: you encrypt your secrets in the .env file and then they are “injected” at runtime with a key secured in the vault.

So what does your agent see? Only the encrypted values, which are useless without the key.

Implementing the vault was a fun project I completed in an afternoon. Here are a few tips I can share after going through the process (as well as a funny mistake I made):

1. If your secrets were not protected before, start by rotating them all. Encrypting them will be useless if they were at some point visible to your agents.
2. Do the same if you usually paste secrets in your terminal. Example: I used to paste my database URLs to run migrations, so they were visible in my shell history. I rotated them and now they are used directly through the vault.
3. Keep separate secrets for pre-production and production environments. This is simply a good practice that you can start now if you didn’t do it before.
4. A nice way to encrypt your secrets is through your terminal, but how to do this without pasting the secret itself in the terminal? You can research command-line functionalities like “pbcopy” and “pbpaste”, which take the secret directly from your clipboard without pasting the raw values anywhere. Cool tip I learned from Claude.
5. Related to the above: clear your clipboard history once you’re finished with the secret encryption. 
6. Be careful with human mistakes, like incorrect copy/pasting. During implementation, I failed to copy a certain error message and the next thing in my clipboard was a fresh API key, which I pasted directly into an AI chat and sent to it. I had to rotate it again immediately 😄
7. Smoke test all secrets in the real app. I recommend doing it one by one after they are encrypted and stored in the vault, in both pre-production and production. This is a delicate matter, so it’s better to do it slowly and prevent mistakes that may break the app later.

The rest is a simple and even fun process. If you are new to this kind of task, I recommend using the help of AI to better understand what you’re doing on each step.

(Just be careful not to give your secrets to it and everything should be fine!)

The vault is not perfect, and further measures can be taken to harden your security even more.

Think of this as a first step. A nice way of making things more difficult for attackers so they think “too much work. Let’s better skip this one!” as well as a way to get into the cybersecurity world and gain awareness about the risks of using AI.

We should all be learning about security these days, and simple-but-impactful tasks like this give you a nice sense of accomplishment as well as hunger to learn more—exactly what you want in order to keep yourself going.