alt Hacker NewsDoes secret injection really prevent that the agent send my GitHub key somewhere? If it has access to it via env var, can it not just paste it somewhere?
Replies
eli • today at 9:21 AM
It’s injected into an outbound api call, not into an env var the agent can read.
➕ show 2 replies
The env var is just a placeholder in the VM, so no real secret is in there.