Modified
Security decides whether the rest holds up
You have just built your first . It works. But an is sitting in your code. You push to GitHub. Within 30 seconds the key is on the open market. The bill arrives tomorrow.
Security is not about paranoia — it is about not becoming the next headline.
A bot scans GitHub every 10 seconds for newly uploaded files containing API keys. Average time from push to abuse: under 30 seconds. The bills that follow can run into thousands of kronor within hours. There is no undo button.
This page lays out the four things you have to get right: how to handle keys, how to store them, how to isolate the agent, and how to avoid bad packages.
API keys
An API key is a password for machines. It identifies who is making a request and who gets billed. If your key leaks, anyone can make calls in your name — and you pay the bill.
Rotation
Rotate keys regularly, and immediately if you suspect exposure. All major providers (OpenAI, Anthropic, Google) let you create new keys and revoke old ones with no downtime.
Scope limitation
Create dedicated keys per project and give each one the smallest possible permissions. A read-only key should not be able to write.
Revocation
Track every active key in a list. Revoke keys that are no longer in use immediately. An old key you forgot about is an open window.
.env files
A in your git repo is like the house key in the shop window. It contains all your API keys and database passwords in plain text. One wrong push and a stranger can read it within minutes. Three routines protect you.
# .env — NEVER COMMIT THIS FILE TO GIT OPENAI_API_KEY=sk-proj-abc123... ANTHROPIC_API_KEY=sk-ant-... DATABASE_URL=postgresql://user:pass@host/db
.gitignore
Add .env and .env.local to before you create the files. If git is already tracking the file: git rm --cached .env
dotenv libraries
Use dotenv (Python/Node) to load env variables from .env locally. In production the variables are set directly in the environment — no .env file needed.
Vault alternatives
HashiCorp Vault, AWS Secrets Manager, or Vercel/Railway env management for teams. are never stored on the filesystem, only injected at runtime.
Sandboxing
An agent with tools can read files, run commands, and make network calls. Without isolation, a — an attacker instruction hidden in data the agent reads — can hand over full control of your machine. Isolation contains the damage to the .
Docker isolation
Run the agent’s execution code in a with no volume mounts to the host filesystem. Restrict network access with --network none or custom networks.
Deno sandbox
Deno requires explicit flags for filesystem, network, and environment access. An agent running JavaScript in Deno without flags cannot read files or make HTTP calls by default.
E2B
E2B is a cloud-based sandbox environment built for AI agents. The agent runs code in an isolated VM — you do not have to manage Docker and isolation yourself. A fit for production systems that execute code.
Where is your data stored when you use an AI service? What does GDPR actually mean in practice for someone building with AI? It is covered on its own page. Go to Data Sovereignty →
Supply chain, dependencies, and risks
pip install and npm install pull in code from thousands of third-party packages — code you have never reviewed. In ordinary applications the risk is limited. With that have filesystem access and can run commands, a single compromised package can hand over full control of the agent’s execution environment.
Version pinning
Always lock package versions in requirements.txt or package-lock.json. pip install openai==1.30.0 instead of pip install openai. Upgrades happen deliberately, not automatically.
Dependency scanning
Snyk and GitHub Dependabot scan your dependencies automatically against known vulnerabilities. Free for open source. Set it up once — it alerts you when a package you use has a CVE.
Private registries
Companies with strict security requirements mirror approved packages in a private registry (JFrog Artifactory, AWS CodeArtifact). No package is installed without review. The right call for production systems with sensitive data.
Common questions
What is prompt injection?
An attack where someone hides instructions in text your AI reads, for example in an email or on a web page. The model can be tricked into leaking data or running the wrong commands. Protect yourself with least privilege and human approval for sensitive steps.
Is it safe to give an agent access to my files?
Only if you constrain it. Grant read access before write access, run the agent in a sandbox, and log what it does. The more power the agent has, the more control you need.
What do I do if my API key has leaked?
Revoke the key with the provider immediately and create a new one. Check your bill for unexpected usage. Then move your keys into a secrets manager instead of your code.