Vibe Coding Will Get Your API Keys Stolen — .env and Keychain Won't Save You

In a previous experiment, I tested 10 prompt injection attacks against CLAUDE.md defenses. One finding stood out: without protection, an attacker can make the AI agent display the contents of .env . That means: as long as your API keys live in .env , a prompt injection is all it takes to steal them. So where should you put your keys? Let's test the options. Why .env Is No Longer Safe The old reasons .env was dangerous: Forgot to add it to .gitignore Keys leaked into shell history Keys appeared i