Stage 2 · Lesson 5 of 6
Keeping secrets out of reach
Anything your tool reads may be sent to a , so keep secrets out of what it can see. Store keys in or a secrets manager, never in code, and list .env in .gitignore. Then use your tool's controls.
In Claude Code, a such as Read(./.env) in .claude/settings.json blocks its file tools. Cursor ignores .gitignore entries and .env files by default, and .cursorignore adds more. Copilot has content exclusion in settings, though GitHub notes in IDE chat does not honour it.
None of these is a complete barrier: a terminal command the agent runs can still read a file.
Common traptrusting ignore rules alone; the real fix is keeping production secrets off your development machine and out of the project folder.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with
- GitHub repoFreeGitHub Skills: Getting Started with GitHub Copilot
GitHub · Beginner
A free hands-on exercise in a browser Codespace, done in under an hour