Open-source kdbx tool lets AI agents use secrets without leaking them
nabsha · reddit · 2026-08-01
A developer noticed Claude Code reading .env files, exposing API keys in transcripts on remote servers. He built an open-source tool called kdbx that stores secrets in a KeePassXC vault outside the repo, injecting them into child processes via kdbx run -- npm test without printing anything. Agents can run commands needing credentials, but writing, revealing, or exporting secrets stays with the human. The tool stops accidents, not attacks. The author compared 1Password, Doppler, Infisical, sops, age, direnv, and pass, choosing KeePassXC for local, offline, out-of-repo, and per-project layout.
More from coding & agent
- SGLang Supports Inkling-Small on Dual DGX Spark, Hits 24 tok/s — ying11231 · 2026-08-01
- AI Agents Integrate with Sentry Alerts for Automated Incident Triage — zeeg · 2026-08-01
- Task Marketplace for Agentic Workflows Built on x402 Protocol Surfaces — MurrLincoln · 2026-08-01
- Enterprise MCP Deployment Pain Points: Who Enforces Agent Tool Access at Runtime? — Common_Dream9420 · 2026-08-01
- Continual Harness: A Self-Improving Architecture for AI Agents — chijinML · 2026-08-01
- Read-Only by Design: An MCP Server for Secure Agent Secret Management — nabsha · 2026-08-01