Your AI coding tools are reading your .env

You added .env to .gitignore years ago and moved on. In 2026 that's no longer enough — because the tools in your editor have changed.

.gitignore stops commits, not reads

AI coding assistants — Cursor, GitHub Copilot, Claude Code, and the rest — read files directly off your filesystem to build context. .gitignore only tells git what not to track. It does nothing to stop a process (an assistant, an extension, a dependency's postinstall script, or malware) from reading the plaintext file sitting on your disk.

So a real, current risk: your production database URL or Stripe key gets slurped into a prompt, a telemetry payload, or a model context window — without you ever pasting it anywhere.

The fix: don't keep secrets on disk

The strongest mitigation is simple — keep secrets out of a plaintext file entirely, and inject them straight into the process that needs them:

$ envsync run -- npm start

envsync run pulls your secrets, decrypts them in memory, and hands them to your app as environment variables — nothing is written to disk. There's no plaintext file for an AI tool (or anything else) to read.

When you do need a file

Sometimes a tool really wants a .env. envsync pull writes one on demand — and because the vault is versioned, you can roll back or re-pull anytime. The point is that the file becomes a deliberate, short-lived choice instead of a permanent plaintext liability.

And it's encrypted end to end

EnvSync encrypts on your machine (AES-256-GCM) before anything is synced — the server only ever stores ciphertext. So you're covered on both fronts: secrets aren't sitting in plaintext locally, and they aren't readable on the server either. How the security model works →