u/Forkbench

The .gitignore part is what usually catches people out. It tells git what not to track, but the agent doesn't care about that. If it greps the folder, it'll happily pull the raw value into its context, which then gets sent to Anthropic.

The only downside with the .env approach is that the agent actually sees the raw key, so it ends up in the model's context/transcript.

That's why I built Forkbench: the agent can still use the keys, but never actually sees them.