How I Secured My Project’s Secrets Using a Tool from Homebrew’s Creator

Listening to the top professionals in your field usually results in learning lessons that you would otherwise learn through a catastrophe.

These days, I’ve been following Kun Chen, a former Meta principal engineer who shares plenty of advice on improving your developer workflow. Among all his recommendations, something he mentioned in passing stuck with me.

It turns out that AI agents can freely read your project secrets if you simply keep them in plaintext in a .env file. That was my case, and I saw firsthand how my secrets were read.

A while ago, an agent told me about a typo it found in one of my API keys, and while it was useful to correct it on the spot, I knew something was very wrong there—the fact that it could see that typo let me know that it had access to private information that it should not be able to see at all.

Then I remembered that Mr. Chen recommended a tool by Homebrew’s creator, Max Howell, which is exactly for this. It’s called “Automic Vault.”

The tool is simple and powerful. Instead of having your secrets in plaintext, you encrypt them and save the encryption key in the vault. Then, when you run your backend, you “inject” the secrets, making them work as usual.

And what does your AI agent see?

Only the encrypted values, which are useless unless you have the key.

And where is the key?

It’s safely stored in the vault, and it requires your explicit approval each time it is used.

And what happens if you don’t protect your secrets? 

An attacker can get access to your AI chat transcripts and get the raw secrets from there.

Even if you were careful enough to never paste them directly into the chat, if your agents have ever read them from your .env file (which they have likely done) they will be visible to the attacker who steals the transcripts. That’s the reason why this vulnerability is so sneaky—it can hit you even if you were cautious.

The Automic Vault is a nice option. It is easy to set up and, while it’s not bullet-proof, it gives you some peace of mind that your secrets are more secure than they are hanging around in a plaintext file.

For more insights after implementing the vault myself, feel free to read my article “7 Lessons From Securing My Project’s Secrets.”