Skip to content
FlintFlintby Torch
← LevelsBuilder · B2

Secrets & .env hygiene

Build-along · ~10 min at your own keyboard

API keys leak three ways: pasted into chats, committed or synced to shared places, and hardcoded in scripts. A .env file is a convention for keeping keys in one place — it is not a lock. Protection comes from three things you set up before the key exists: the file is excluded from version control and sync, Claude is denied permission to read it, and scripts load the key by name. Practice with a dummy key first, and test that the value doesn't show up anywhere it shouldn't.

The long version: Keeping secrets out of chats ↗

Mac: Mac: .env is a hidden file. Create it with touch .env and view it with ls -a.

Windows: Windows: Notepad may save it as .env.txt. Create it from VS Code, or in PowerShell with New-Item .env, and check the name.

Do this

0/5

Checkpoints

  • ▸You should now see .env listed in .gitignore before the file exists.
  • ▸You should now see Claude blocked when asked to read .env.
  • ▸You should now see the dummy value found only in .env, and an audit listing any stray credentials.
The three ways this goes wrong
  • The script cannot find the key. — Run it from the folder that holds .env, check the variable name matches exactly with no spaces around the equals sign, and check the script actually loads .env (many languages need a small library for that).
  • You pasted a real key into the chat. — Treat it as leaked. Rotate it at the service now, then put the new one in .env.
  • The .env file got committed or synced to a shared folder. — Add .env to .gitignore, remove it from the shared location, and rotate the key.

Dated facts in this lesson: Claude Code permission rules use the form Tool(specifier), e.g. Read(./.env) in a deny list, managed with /permissions or settings.json (researched Oct 2, 2026, not yet confirmed by a person: check the source before you rely on it).

Share what happened

Paste your .gitignore line, your deny rule, the three boundary-test results (blocked read, git status, search), and the audit result. Mask any real key values.

Strip API keys, passwords, and tokens before you paste. Swap them for [KEY].

🔒 Don't paste confidential, personal-health, or payment info.