Open-Sourcing Towel: A Local Proxy to Hide API Keys from Coding Agents
Patient_Path_6809 · reddit · 2026-08-02
A developer open-sourced a CLI tool called Towel (twl) to address a critical security risk in coding agents: the ability to read and expose live API keys from a project's .env file.
How It Works
Towel acts as a localhost proxy. It keeps the real API key hidden and provides the agent with a fake key and a local URL. When a request is made, Towel swaps the fake key for the real one on the way out, directing it only to the registered API.
Security Boundaries
This tool is not a sandbox; the agent can still use the live API (e.g., creating charges) through the proxy during the session. Its core value lies in removing the credential itself, ensuring that anything the agent logs, prints, or leaks is effectively useless. It is currently in alpha, Linux-only, and unaudited.
More from coding & agent
- GitHub rewrote the 800k-line Copilot runtime in Rust using AI agents, cutting CPU and memory by over 90% — bibryam · 2026-10-16
- What's the hardest part of deploying AI in real businesses that nobody talks about — djgoel123 · 2026-10-16
- DeepMind turns coding agent Antigravity into a science tool, surfacing novel antimicrobial peptide in one session — pushmeet · 2026-10-16
- Cross-review coding workflow: Claude writes the plan, Codex audits it — theteknosaur · 2026-10-16
- NPCTalk makes GTA V NPCs conversable in ~1s, open-sourced for any game — ChocolateDull8971 · 2026-10-16
- Simon Willison: code mode is the future of tool calling, if it can be sandboxed — springrod · 2026-10-16