I vibecoded a secrets proxy to keep credentials out of cloud coding agents

andersonbcdefg · x · 2026-10-11

Developer Benjamin Anderson details his homebrewed secrets proxy for cloud coding agents:

Context: open-weights models are too good to ignore; he previously built a 'guardian' between GLM and his CLI to prevent data exfiltration or destructive commands. But workloads are moving to the cloud, making secrets management the next paranoia.
The problem: agents need secrets to work, but once a secret enters the context window it goes to a provider you may not trust — and agents risk leaking it publicly ('LOOT' files).
Architectures: he contrasts agent-in-the-sandbox vs sandbox-as-a-tool, arguing the debate is settled until harnesses support truly remote bash execution.
Solution: a self-built secrets proxy acting as a middle layer between agents and real credentials, keeping secrets out of agent context. The whole proxy was generated by Claude as 6,000 lines of Go in one shot.

More from coding & agent