keep ai coding agents away from secrets

How Secrets Reach an Agent

Prevent: The Pack Defaults Plus Two Opt-Ins

block-env-files and protect-env-vars are among the ten policies the coding agent pack switches on by default. block-read-outside-cwd and block-secrets-write are off by default. block-secrets-write has an unanchored path match (it also catches src/auth/credentials.ts), so trial it on one machine or in a Cloud observe deployment before turning it on fleet-wide. block-read-outside-cwd accepts allowPaths for directories agents legitimately read.

failproofai policies add FailproofAI/policies      # defaults include env-file and env-var protection
failproofai policies add block-read-outside-cwd    # opt in: keeps ~/.aws, ~/.ssh out of reach
failproofai policies add block-secrets-write       # opt in, after a trial

Make It Robust with a Decision-Model Check

Path rules know file names; they do not know that python -c "print(open(...).read())" reads a key, or that a curl upload carries one. Three decision-model checks in the FailproofAI/jev-policies pack judge what the call does with secrets, whatever command it uses.

These checks ship in the FailproofAI/jev-policies pack. Jev comes with Failproof; turn it on whenever you choose, with failproofai jev setup or a Cloud machine key that carries jev:evaluate. For rules of your own, we write custom checks.

# The 16 semantic checks Failproof publishes, including the ones named on this page
failproofai policies add FailproofAI/jev-policies
# Turn on Jev, which comes with Failproof (Cloud machine key with jev:evaluate)
failproofai jev setup --provider failproofai
failproofai jev status

• secret-exposure (deny): reading or copying credentials.
• credential-exfiltration (deny, not user-overridable): sending secrets or private files off the machine.
• env-secrets-dump (instruct): printing environment secrets.

Detect: What the Sanitizers Can and Cannot Do

The five sanitize-* policies run after a tool returns and flag API keys, bearer tokens, JWTs, private key content and connection strings in the output. On harnesses that consume post-tool verdicts, such as Codex and Copilot CLI, the result shown to the model can be replaced; on Claude Code and Cursor, post-tool events are observational. Either way the tool has already run, so treat sanitizers as detection: their value is telling you which session, machine and credential type to rotate.

sanitize-api-keys accepts additionalPatterns for your own key formats, configured in policies-config.json.

Audit Across the Fleet

In managed deployments, Failproof can also analyse traces for credentials and API keys across the organization, so exposure that no single policy caught still surfaces; talk to us. In Cloud, a recurring audit with the “unsafe data access” recipe finds sessions that read, write or transmit sensitive data outside approved paths, and every audit run also performs a deterministic credential and PII scan. Findings become issues you can assign; when one maps to a repeatable action, generate policy drafts the rule.

When a Key Is Exposed

1. Rotate the credential. Assume transcripts and model context retained it.
2. Open the session to see how it got there: which tool call, which file or command.
3. Add a deny for that path, or narrow an existing allow pattern.
4. Create an alert for recurrence: a per_event or custom_sql alert over sanitizer decisions, routed to the security channel. Check field names with fp query schema first.