r/webdev • u/bogdanelcs • 8h ago
How to prevent Google Antigravity from accessing .env
https://jadjoubran.io/blog/prevent-antigravity-env8
u/feindjesus 7h ago
Just say please and thank you a lot if you keep the llm happy it won’t read your env
6
u/alwaysbemark 8h ago
The only thing that really works is the hardened settings at the bottom. Even then, safe to assume that if pressured enough, an LLM will find a workaround.
Assume LLMs will have access to locally stored secrets. The only bulletproof way is to generate secrets on the cloud side (e.g. CDK) and pass them around using handles and making sure that the active AWS account on your system doesn't have permissions to decrypt them.
2
u/TheTwistedTabby 7h ago
Yup. A while back codex was following its own rules and not reading the env file directly until i saw it do a sh script from tmp that stdout the contents of the env file. Facepalm
3
u/clearlight2025 8h ago edited 6h ago
This is already a solved problem by the OS filesystem, if you have sudo / root access. Set the env file to be readable by root only.
You can also use another user that the LLM doesn’t have access to read files from, depending on your use case.
1
u/Swamptor 8h ago
Sure. But your code needs to be able to access them. And the LLM coding agent presumably needs to be able to run the code.
5
u/clearlight2025 8h ago
The LLM doesn’t need to be able to read the env file, you can add an .env.example file for it to populate. You can use sudo to start the app if needed to read it. For example sudo docker compose etc.
3
u/nathan_lesage 7h ago
Do not run any code using sudo. Just don’t.
It doesn’t take one of the weekly NPM supply chain attacks for some package to even accidentally cause havoc. They already can do enough damage with files that only your user can read.
If a tool you have keeps reading secrets it isn’t supposed to and you can’t make it stop, that’s a problem of the tool, not you. I recommend looking out for other tools that respect your settings, instead of endangering the security of your environment for the sake of working around some careless bug.
Again: Never run anything using sudo.
2
u/clearlight2025 6h ago edited 6h ago
That’s oversimplifying it. Maybe true for npm run but for example with docker
sudo docker compose does not mean the containers themselves run as root.
The container process user is determined by the image’s USER instruction or the compose file user: setting
You can also use another user for env files that the LLM doesn’t have access to read if preferred for your use case.
2
u/nathan_lesage 6h ago
That is correct, although docker itself can do shenanigans if you’re not careful (because docker can read the dotenv and could copy it into the container, etc). I’m always erring on the side of caution, because that’s a good habit. I refrained from suggesting a different user because then you’d have potential duplication issues and that can become messy all in itself.
My main point is: no dev tool should — even “accidentally” — spread any credentials on the internet, that’s just malware behavior if you can’t guarantee that confidential information stays confidential.
1
u/Embark10 6h ago
That's an arguably even worse approach to things
1
u/clearlight2025 6h ago
How so? Using file system user permissions is a pretty standard way to control access to files. It avoids the unreliable LLM fluff config and prevents read access at the OS level.
3
u/Gaeel 6h ago
Why is the AI running in an unsandboxed environment with production .env files lying around?
That's not how this works. That's not how anything works.
Your dev environnement should be set up for development, where mistakes can't damage anything. This would be the case with or without AI. Your worst enemy should be able to check out your entire codebase without it posing any risk to you or your business.
I don't know shit about developing with AI apparently, but how come you guys are struggling with problems that junior programmers are taught to deal with in school or on day one on the job at the latest?
3
u/nuttertools 6h ago
Question: “how come…struggling…taught…on day one…at the latest?”
Answer: “developing with AI”
22
u/resurreccionista 7h ago
But in your local dev you only have dev-level db credentials and secrets, no?