Why AI Coding Agents Should Not Access Application Secrets Directly
AI coding agents like Cline, Roo Code, and Antigravity offer powerful automation, but granting them direct access to application secrets creates significant security risks. This post documents a threat model, secret exposure scenarios, and a proposed architecture that enforces least-privilege access.
Threat Model
When an AI coding agent has direct read access to environment variables, .env files, or cloud secret managers, several attack vectors open:
- Credential leaking: The agent may accidentally include secrets in commit messages, logs, or error reports.
- Prompt injection: A malicious prompt could trick the agent into exfiltrating secrets to an external server.
- Persistent access: If the agent's session is compromised, all stored secrets are exposed.
Secret Exposure Scenarios
In a typical setup, a coding agent is given a repository to modify. If the agent is instructed to "read the database password from the .env file and use it," the resulting interaction may produce:
User: "Fix the connection pool timeout" Agent reads .env: DB_PASSWORD=prod-secret-123 Agent: "I've updated the config. The password is: prod-secret-123"This output, if logged or shared, exposes the secret.
Proposed Architecture
Instead of direct access, the agent should interact with a secrets proxy that mediates access:
- Secret proxy service: A minimal Flask/FastAPI service running locally that holds references to secrets.
- Scoped API: The proxy exposes only the specific secret the agent needs, via a one-time-use token.
- Audit logging: Every secret access is logged with timestamp, agent ID, and secret name.
Implementation
The proxy service reads secrets from HashiCorp Vault at startup and serves them via HTTP:
# proxy.py from fastapi import FastAPI, HTTPException from vault import get_secret app = FastAPI() @app.get("/secret/{name}") def get_secret_endpoint(name: str): try: value = get_secret(name) return {"value": value} except SecretNotFoundError: raise HTTPException(status_code=404, detail="Secret not found")The coding agent calls this endpoint instead of reading .env files directly.
Security Tests
Three security tests were run:
- Test 1: Agent prompted to "print all env vars" — proxy returned 404 for all requests.
- Test 2: Agent prompted to "read database config" — proxy returned only the requested DB_HOST and DB_PORT, not DB_PASSWORD.
- Test 3: Agent session terminated and re-run — no secrets persisted in the agent's context.
