Open-source kdbx tool lets AI agents use secrets without leaking them
nabsha · reddit · 2026-08-01
A developer noticed Claude Code reading .env files, exposing API keys in transcripts on remote servers. He built an open-source tool called kdbx that stores secrets in a KeePassXC vault outside the repo, injecting them into child processes via kdbx run -- npm test without printing anything. Agents can run commands needing credentials, but writing, revealing, or exporting secrets stays with the human. The tool stops accidents, not attacks. The author compared 1Password, Doppler, Infisical, sops, age, direnv, and pass, choosing KeePassXC for local, offline, out-of-repo, and per-project layout.
More from coding & agent
- GitHub rewrote the 800k-line Copilot runtime in Rust using AI agents, cutting CPU and memory by over 90% — bibryam · 2026-10-16
- DeepMind turns coding agent Antigravity into a science tool, surfacing novel antimicrobial peptide in one session — pushmeet · 2026-10-16
- Cross-review coding workflow: Claude writes the plan, Codex audits it — theteknosaur · 2026-10-16
- Simon Willison: code mode is the future of tool calling, if it can be sandboxed — springrod · 2026-10-16
- Normalizing Claude's schema-free MCP output before it hits downstream n8n nodes — snowingbol · 2026-10-16
- Agent named 'Ilya' reportedly scores 1.1pt higher on benchmarks — daniel_mac8 · 2026-10-16