How to keep secrets out of an AI coding workspace
Use fake values for routine agent work, isolate credentialed tests, and deliver restricted development secrets only after reviewing the code.
Dopbase guides
Secrets management and safer AI coding.
We write practical guidance for developers handling application secrets, plus honest notes about the decisions behind Dopbase. Product examples use the current Dopbase command-line interface.
Why development should not use production secrets
Separate development and production credentials so a mistake on a laptop, test runner, or coding agent cannot reach live systems.
Committed a secret? Revoke it before cleaning Git history
Deleting a committed secret does not disable it or remove it from Git history. Revoke or rotate it first, then clean the repository.
Can an AI coding agent read your .env file?
Yes, a coding agent can usually read an ignored .env file. Learn where credentials can leak and how to keep real secrets outside its workspace.
Why we're keeping Dopbase's secrets model small
Dopbase uses three concepts: projects, environments, and secrets. We explain why the model stops there.
