Tag: DevSecOps
-
Your Coding Agent Can Read Your .env — And That Changes Your Security Model
A few days ago, I was working with on my side project gogetcv.com, suing a coding agent (OpenCode) and and noticed something uncomfortable. It opened my appsettings.dev.json. These was LLM API keys for different providers and I had to rotate all of them. It hit me, the normal local development config file that almost every…