alt Hacker NewsHow do you actually cleanly solve that .env issue?
Anything cross platform and coding agent agnostic?
I suppose that .env file should be removed, but then things aren’t easy: no native multiplatform secret manager, or the std lib of the language doesn’t offer an API over the native secret store, etc.
Or a "secret injection proxy" for some cases could work I guess.
Replies
https://varlock.dev (free, open source) can pull secrets from many places, and has a credential broker (proxy) to inject placeholders, then replace with real secrets at the network boundary. There are a few other tools like this, but ours seems to be the most flexible so far.
Do you feel that something like https://secretspec.dev/ addresses these points?
Data retention clauses?
I dont see how you can ever really trust an LLM anyway to follow instructions.
[flagged]
Infisical, or Bitwarden Secret Manager? Those two look like perfectly reasonable if the llm is just careless (but still, nothing prevents the LLM from intentionally cat'ing /proc/self/environ or from running /usr/bin/env or set or similar)