Your AI Coding Tools Are Leaking Your API Keys

1. Context Window Ingestion

When an AI assistant opens your project, it indexes files to understand your codebase. If .env is in the project root, the AI reads it to “understand your configuration.” The key values enter the context window and get sent to the inference API.

Once in the context, credential values can appear in several places: API request logs on the provider side, model training feedback loops (for tools that train on user interactions), and autocomplete suggestions shown to you or other users.

# What the AI sees when it reads your .env
OPENAI_API_KEY=sk-proj-abc123...def456
STRIPE_SECRET_KEY=sk_live_51Hx...9kZ
DATABASE_URL=postgres://admin:P@ssw0rd@db.example.com:5432/prod
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCY...

These values are now part of the conversation context. The provider's API processed them. Depending on the provider's data retention policies, they may persist in logs.

2. Terminal History

AI coding tools with terminal access can read your shell history. Every export statement and every curl command with an Authorization header is recorded in your history file.

# Commands in your shell history
$ export OPENAI_API_KEY=sk-proj-abc123...def456
$ curl -H "Authorization: Bearer sk-proj-abc123..." https://api.openai.com/v1/models
$ psql "postgres://admin:P@ssw0rd@db.example.com/prod"

When the AI reads ~/.zsh_history or ~/.bash_history to understand your workflow, it ingests every credential you have typed or pasted into your terminal.

3. MCP Server Configurations

The Model Context Protocol (MCP) connects AI assistants to external tools — databases, APIs, cloud services. Each MCP server needs credentials to authenticate. These credentials are stored as plaintext values in JSON configuration files.

// claude_desktop_config.json
{
  "mcpServers": {
    "stripe": {
      "command": "npx",
      "args": ["-y", "@stripe/mcp"],
      "env": {
        "STRIPE_SECRET_KEY": "sk_live_51Hx...9kZ"
      }
    },
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_abc123..."
      }
    }
  }
}

The AI assistant reads these configs to discover which tools are available. In doing so, it reads the API keys alongside the tool definitions. This is a structural problem with how MCP configs are currently designed — tool metadata and secrets live in the same file.

Your code should reference credential names, never credential values. When the AI reads your source code, it sees a variable name — not a secret.

const stripe = new Stripe(
  "sk_live_51Hx...9kZ"
);

const stripe = new Stripe(
  process.env.STRIPE_SECRET_KEY
);

The AI sees process.env.STRIPE_SECRET_KEY and knows the variable name, but never learns the value. It can still generate correct code that uses the credential.

Instead of .env files, store credentials in a backend the AI cannot access: the OS keychain, an encrypted local store, or a password manager like 1Password.

# Store a secret in the encrypted backend
$ npx secretless-ai secret set STRIPE_SECRET_KEY
  Enter value: ********
  Stored STRIPE_SECRET_KEY (encrypted)

# Use OS keychain for hardware-backed encryption
$ npx secretless-ai backend set keychain
  Backend: macOS Keychain (hardware-backed on Apple Silicon)

Secrets stored in the OS keychain are protected by your system login credentials and, on Apple Silicon, by the Secure Enclave hardware. The AI tool has no mechanism to read from the keychain directly.

Even with secrets in a backend, legacy .env files may still exist in the project (other team members, CI configs, migration in progress). Block the AI from reading them.

# Secretless blocks these patterns from AI context
.env
.env.*
*.key
*.pem
*.p12
.aws/credentials
claude_desktop_config.json
.cursor/mcp.json

For Claude Code, this is enforced with hooks that intercept file reads before they execute. For other tools, instruction files tell the AI to skip these patterns. The result: the AI never sees credential values, even if the files are present.

Credentials are decrypted and injected as environment variables only when your application starts. They exist in process memory during execution, but never at rest in project files.

# Inject secrets and start your app
$ npx secretless-ai run -- npm start

# Inject only what is needed (least privilege)
$ npx secretless-ai run --only DATABASE_URL -- npm run migrate

# Works with any command
$ npx secretless-ai run -- python app.py

The AI tool can observe that your application started successfully, but it cannot read the injected environment variables. The credential values are never written to disk and never enter the AI context window.