Open-Sourcing Towel: A Local Proxy to Hide API Keys from Coding Agents
Patient_Path_6809 · reddit · 2026-08-02
A developer open-sourced a CLI tool called Towel (twl) to address a critical security risk in coding agents: the ability to read and expose live API keys from a project's .env file.
How It Works
Towel acts as a localhost proxy. It keeps the real API key hidden and provides the agent with a fake key and a local URL. When a request is made, Towel swaps the fake key for the real one on the way out, directing it only to the registered API.
Security Boundaries
This tool is not a sandbox; the agent can still use the live API (e.g., creating charges) through the proxy during the session. Its core value lies in removing the credential itself, ensuring that anything the agent logs, prints, or leaks is effectively useless. It is currently in alpha, Linux-only, and unaudited.
More from coding & agent
- Tencent Releases UI-Mate-27B, a Desktop GUI Agent Model — tencent · 2026-08-24
- Comparing AI Subscriptions: DeepSeek API vs. Claude Pro vs. Local LLMs — Unlikely_Bluejay5392 · 2026-08-24
- Claude Code introduces 'Remote Control' feature to boost coding efficiency — rohanpaul_ai · 2026-08-24
- rauchg lays out fx extension philosophy: MCP, Skills, Plugins and Unix composition — AccBalanced · 2026-08-24
- Netflix details its production LLM judge: hundreds of thousands of recommendations scored weekly — omarsar0 · 2026-08-24
- smolvm passes Simon Willison's Fable 5 agent test as a secure sandbox — yawnxyz · 2026-08-24