AI agents

Latest posts

• coding-agent-payments-devService token for a coding agentActive

  Environments (1)payments-api / developmentdev

  No production key is ever sealed to this token.

  AI agents·October 30, 2026

  API keys in MCP server configs: where they end up

  MCP clients keep server settings as plain JSON, and the API key usually sits in it. Where those files live, who can read them and how to keep keys out.

  AI coding agents guide

• ~/code/payments-apiWhat the agent can read

  .envnot on disk

  .env.examplenames only

  src/

  tests/

  package.json

  AI agents·October 30, 2026

  Do AI coding agents read your .env files?

  What Claude Code, Cursor and Copilot do with .env files by default, why ignore rules don't stop an agent's shell, and how to test it with a fake key.

  AI coding agents guide

• ~/code/payments-apiWhat the agent can read

  .envnot on disk

  .env.examplenames only

  src/

  tests/

  package.json

  AI agents·October 30, 2026

  Prompt injection meets your environment variables

  A coding agent with a shell can print its environment, and text it reads can ask it to. How to make the keys within its reach worth little.

  AI coding agents guide

Example. Kiteline is a fictional company.