How to let an AI agent work in your repo without leaking your secrets

Short summary

Coding agents that read your files and run your shell also read every plaintext secret on disk. This guide advocates moving all secrets into OS-encrypted stores (Windows DPAPI, macOS Keychain, Linux libsecret), using OAuth credential managers for git, and building small encrypted vaults for oversized API keys. Includes a Windows-specific trap where wincred store caps entries at 2560 bytes and silently fails on large OAuth tokens.

• •Move secrets from dotfiles into OS-encrypted stores scoped to your account
• •Use OAuth credential managers instead of pasted PATs for git authentication
• •Watch for Windows Credential Manager's 2560-byte limit on large OAuth tokens from non-GitHub forges

Generated with AI, which can make mistakes.