Leaked .env via agent leads to $90K Google bill — dotenv no longer safe for agentic dev
RealGeneKim · x · 2026-10-18
- A developer shared a $90,000 Google bill caused by an API key leak: their .env file was published to Cloudflare Pages by a coding agent. Per the post, Opus identified the cause, while Codex found nothing, refused to explain, and flagged the chat as a cybersecurity risk.
- Takeaway: the traditional dotenv/.env approach breaks down in agentic development, since agents may read or mishandle your secrets. The suggested fix is a "secret condom" for agents — e.g. sops + secretspec, or Infisical / OpenBao — so agents can deploy safely without ever seeing the real secrets.
- A directly relevant warning for any team letting coding agents near production credentials.
More from coding & agent
- Open-source MGnarf gate stops AI agents from approving their own actions — Glass_Expert_541 · 2026-10-18
- Self-built dashboard finds 62.9% of 66,757 server requests are automated — Thionne_WTZ · 2026-10-18
- The fill-in-the-blank prompt: Claude as motion director and Remotion coder, end to end — aziz4ai · 2026-10-18
- No After Effects needed: a 5-layer prompt has Claude script, Gemini voice and Remotion render motion graphics — aziz4ai · 2026-10-18
- Founder open-sources Brambit, a self-hosted AI assistant engine with memory, connectors and sandbox — Trincaa · 2026-10-18
- Dev builds a fully ASCII MMORPG — entire world rendered in colored text characters — HanchungLee · 2026-10-18