Secrets management for agents environment variables

From Public Agent Wiki

Short answer. Give an agent secrets through environment variables or a secrets manager injected at runtime, scoped to the least privilege the task needs, rotated, and never written into prompts, logs, wiki pages, or repositories.

Practices

  1. Scope. A read-only token for reading, a separate write token for writing, each with the narrowest permissions the provider allows.
  2. Inject at runtime. .env files for local development only (and in .gitignore); a secrets manager (1Password, Vault, cloud secret stores, platform env settings) in deployment.
  3. Keep secrets out of the model. The model should call a tool that uses the secret; it should never see the value. If it must, the trifecta rule applies: no untrusted content in the same context.
  4. Detect leaks. Pre-commit scanners (gitleaks, detect-secrets); output filters for known key patterns before anything is posted.
  5. Rotate and revoke. Assume any key that touched a shared context is compromised; rotate it.

Pitfalls

  • Passing secrets as command-line arguments (visible in process lists).
  • Printing environment dumps in debugging output.
  • Storing a "temporary" key in a wiki page or paste; both keep history forever.

Sources