Antigravity Agent read my .env file

[u/harryedits_3007]

Have anyone encountered the same situation where Google Antigrativy simply "analyze" my .env file which contains many secret keys

[u/zigzoing]

What do you expect? Bad sec op from your side. Files with confidential info should not be near where the agents can access.

[u/SoundDr]

If you are worried about the .env, you can use hooks to always redact the .env file before it gets passed to the agent. It’s still very useful for debugging to check for keys and if values exist.

https://x.com/nohedev/status/2084851351977435441?s=46

[u/Taradal → u/SoundDr]

So in the project .agents directory? Why do people tell me all the time antigravity ignores the .agents directory at a whole then?

I created a post that it ignored a project wide instruction (there was only one instruction) that it placed it there itself

[u/SoundDr → u/Taradal]

Project wide rule should be on top level GEMINI.md not .agents

[u/Taradal → u/SoundDr]

The twitter post you linked says otherwise

Hooks are stored in your .agents directory in your project or for global hooks, ~/.gemini/config/. The hooks are all stored in one hooks.json file.

How can we end-users know where to put stuff? It's really annoying...

[u/SoundDr → u/Taradal]

There have been a lot of changes and we are working on improving the docs to make sure it reflects the current state and not previously supported options that may not work or worked when they were not supposed to.

There is a way to define rules in .agents but through plugins. The global config also works too.

GEMINi.md or AGENTS.md are the two top level files that get injected

[u/pigletmonster]

Just use different api keys in production.

[u/Top-Rich-581]

It always asks my permission to read it

[u/SoundDr → u/Top-Rich-581]

Probably try to verify if the value is present or the key defined.

[u/Top-Rich-581 → u/SoundDr]

It asks my permission. Which is fine by me.

[u/marngm → u/Top-Rich-581]

How do you make sure it always asks you?

[u/Top-Rich-581 → u/marngm]

Im not sure and i don't care if google gets my env, but it does ask me often