What is runtime secret injection?

Runtime secret injection is the practice of delivering secrets to a program at the moment it starts, usually as environment variables set by a wrapper, an agent or the platform, so that the values never sit in the source code, the built image or a file in the project directory.

Build time versus run time

There are three common moments to give a program its secrets:

Run time is the only one where the value isn't copied into an artifact. The OWASP cheat sheet calls build-time injection "not recommended" and says secrets "should never be hardcoded using docker ENV or docker ARG commands" (OWASP).

Ways to do it

• A run wrapper. A command that fetches the values and starts your program with them, like crunu run -- npm start.
• The platform. Container orchestrators, PaaS dashboards and CI systems set variables when they start a process.
• A file written at start and read once, for programs that only take config files. This is weaker, because the file exists for a while.

Why it matters for AI agents

A coding agent reads files in your project and runs commands. If the project has a .env with real values, the agent can read it, quote it in a reply or send it in a request. With injection at run time, the project directory holds no values: only the program you start receives them. That removes the most common path by which agents see secrets.

It doesn't remove all of them. The program, and anything it starts, can read its own environment. If an agent can run the wrapper itself, it can start any program with the values, including one that prints them.

Common mistakes

• Inheriting everything. A wrapper that passes the full parent environment also hands over unrelated credentials from your shell.
• Logging the environment on startup for debugging.
• Writing the values to disk "just for now". That is a .env file again.
• Exporting into your interactive shell. See sourcing an env file: every later command gets the values.

Runtime injection with Crunu

crunu run decrypts an environment in memory and starts your program with its variables. Nothing is written to disk.

crunu run --env web-app/development -- npm run dev

By default the program receives a short allowlist from the parent environment, such as PATH, HOME and LANG, plus the environment's variables, and never crunu's own credentials such as CRUNU_TOKEN. On Linux, the crunu process also closes itself to other processes of the same user, though not to root. With --restart on-change, a new version of the environment restarts the program with the new values.

$ crunu statusMachine “api-prod-1”  Status:              healthy  Server:              https://app.crunu.com  …  Machine fingerprint: R7KQ-M2XD-WPLA-V4TE  Lease until:         2026-11-03 14:20:00  Last checked:        2026-11-02 14:21:07 (12s ago)  Environments (1):    payments-api/production  rev 15, head 4, environment key, files: 2, saved 2026-11-02 14:20:51$ crunu run --env payments-api/production \    --restart on-change -- node server.jspayments-api listening on :8080

$ crunu statusMachine “api-prod-1”  Status:              healthy  Lease until:         2026-11-03 14:20:00  …  Environments (1):    payments-api/production  rev 15, head 4, environment key, files: 2, saved 2026-11-02 14:20:51$ crunu run --env payments-api/production \    --restart on-change -- node server.jspayments-api listening on :8080

The same command runs on servers under systemd and in CI with a service token. Crunu has no agent-specific controls: the separation comes from where values live, not from detecting agents. While an agent works unattended, lock your session with crunu lock. More on this setup: keep secrets away from AI coding agents.

Sources

• OWASP Secrets Management Cheat Sheet, checked October 30, 2026.