From Dev.to
Your coding agent can read your .env. Here's how I reduced the risk
If a coding agent can read your project files, assume it can read your .env too. Ignore rules and editor settings can help, but they are not a security boundary. I moved secret values out of my projec...