Secrets leak through AI coding assistants in three ways: the assistant reads a secret file as context, it writes a key into code, or a developer pastes one into chat. Four controls cover most of it: exclude secret files from context, deny reads, scan before commit, and rotate anything exposed.
The three leak paths
- Context. The tool reads files near your cursor or files you mention. If
.envor a config with live keys is in scope, the key travels with the prompt. - Output. The model writes a placeholder-looking key, or copies a real one it saw earlier in the session, into a source file or a test.
- Human paste. A developer pastes a log, curl command or config into chat to ask for help.
Each path needs a different control, which is why one setting rarely solves it.
Control 1: exclude secret files from context
Some tools let administrators exclude paths. GitHub documents content exclusion for Copilot, where excluded files are not used for suggestions or chat answers. It also states limits: it does not apply to symbolic links or to repositories on remote filesystems, and support varies by tool and mode. Read the limits for your tool before relying on it.
Control 2: deny reads at the agent
Agentic tools usually have permission rules. In Claude Code, deny rules are evaluated before ask and allow rules, and a rule such as Read(./.env) blocks the file tools from reading that file. The documentation also notes that these rules cover file commands it recognizes, not every subprocess, and recommends enabling the sandbox for OS-level enforcement.
{
"permissions": {
"deny": ["Read(./.env)", "Read(./secrets/**)"]
}
}
Control 3: scan before the secret lands
Push protection blocks known credential patterns before they reach a repository. On GitHub it covers command line pushes, web commits, uploads and API requests. Anyone with write access can bypass a block by giving a reason, and each bypass is logged, so decide who may bypass and watch the alerts. Pre-commit hooks add a check on the developer machine, earlier still.
Control 4: rotate and assume exposure
Prevention fails sometimes. Keep a short runbook: revoke, reissue, check access logs for the exposure window, and find where else the key lived. Short-lived credentials shrink the cost of every leak.
Which control stops which path
| Leak path | Exclusion | Deny rules | Scanning | Rotation |
|---|---|---|---|---|
| Context | Strong | Strong | None | Cleanup |
| Output | Weak | Weak | Strong | Cleanup |
| Human paste | None | None | Weak | Cleanup |
Human paste is mostly a training and tooling problem, so pair rules with a clear message about what never goes into chat.
Try it yourself
Click through it at your own pace, or open it full screen.
Open the code scan results and check how a finding points to the exact file and line you would need to fix and rotate.
Quick check
Is a .gitignore enough?
No. It keeps a file out of commits, but an assistant can still read the file from disk as context. Use tool exclusions or deny rules as well.
Does push protection catch every secret?
No. It matches known patterns, so custom or unusual tokens can pass. Treat it as one layer.
Safeguard policies and gates can block risky changes in pull requests, and you can run a free scan at gold.safeguard.sh/scan.
Sources
- GitHub Docs: Copilot content exclusion
- GitHub Docs: About push protection
- Claude Code: Configure permissions
Last reviewed: 19 October 2026.
