3 ms·
How do you deny access to prod credentials from an assistant running on your dev machine assuming you need to store them on that same machine to do manual prod
by ogrisel 10mo ago
How do you deny access to prod credentials from an assistant running on your dev machine assuming you need to store them on that same machine to do manual prod investigation/maintenance work from that machine?
- victorbuilds 10mo agoI keep them in env variables rather than files. Not 100% secure - technically Claude Code could still run printenv - but it's never tried. The main thing is it won't stumble into them while reading config files or grepping around.
- 63stack 10mo agoA process does not need to run printenv to see environment variables, they are literally part of the environment it runs in.
- dist-epoch 10mo agoThe LLM doesn't have direct access to the process env unless the harness forwards it (and it doesn't)
- fragmede 10mo agochown other_user; chmod 000; sudo -k