11 ms·
How do you actually cleanly solve that .env issue? Anything cross platform and coding agent agnostic? I suppose that .env file should be removed, but then thi
by jiehong 1mo ago
How do you actually cleanly solve that .env issue?
Anything cross platform and coding agent agnostic?
I suppose that .env file should be removed, but then things aren’t easy: no native multiplatform secret manager, or the std lib of the language doesn’t offer an API over the native secret store, etc.
Or a "secret injection proxy" for some cases could work I guess.
- sandos 1mo agoData retention clauses? I dont see how you can ever really trust an LLM anyway to follow instructions.
- mehackernewsacc 1mo agoDo you feel that something like https://secretspec.dev/ https://secretspec.dev/ addresses these points?
- ElectricalUnion 1mo agoInfisical, or Bitwarden Secret Manager? Those two look like perfectly reasonable if the llm is just careless (but still, nothing prevents the LLM from intentionally cat'ing /proc/self/environ or from running /usr/bin/env or set or similar)
- adityazero 1mo ago[flagged]
- theozero 1mo agohttps://varlock.dev https://varlock.dev (free, open source) can pull secrets from many places, and has a credential broker (proxy) to inject placeholders, then replace with real secrets at the network boundary. There are a few other tools like this, but ours seems to be the most flexible so far.