Where secrets leak, and how to stop it.

Cursor, Claude Code and Copilot read your working directory. Keep secrets out of it: no .env file, and agent tools that can use a secret but never read one.

Start containers and Compose stacks with your secrets in their environment — never in the command line, never on disk, and without the silent --env-file trap.

Stop pasting .env files into chat. Import yours once, grant each teammate access to the project, and everyone pulls or runs with the same encrypted secrets.