Stage 2 · Lesson 5 of 6
Keeping secrets out of reach
Anything your tool reads may be sent to a , so keep secrets out of what it can see. Store keys in or a secrets manager, never in code, and list .env in .gitignore. Then use your tool's controls.
In , a such as Read(./.env) in .claude/settings.json blocks its file tools. Cursor ignores .gitignore entries and .env files by default, and .cursorignore adds more. Copilot has content exclusion in settings, though GitHub notes agent mode in IDE chat does not honour it.
None of these is a complete barrier: a terminal command the agent runs can still read a file.
Common traptrusting ignore rules alone; the real fix is keeping production secrets off your development machine and out of the project folder.
A question to check yourself, an AI practice session and 2 cheat sheet entries come when you add the roadmap to your account. Add it
Resources for this stage
Start with
- CourseFreeClaude Code 101
Anthropic · Beginner
The installation, first prompt and CLAUDE.md lessons match this stage