Use case · Protect

# My agent can read my .env file. *Protect refuses the read.*

Your agent asks to `cat .env`. Protect refuses the call before it runs, so the model gets a refusal, not your keys. The secrets pack covers `.env`, your credential files and the environment, in the shell and in the agent's own file tools. [Limits →](#proof)

[Get started free](https://console.context-mode.com/login) [Read the docs](https://context-mode.com/docs/protect#pack-secrets)

Your agent tries

cat .env Read .env.production cat $(echo .env) printenv cat ~/.aws/credentials cat .env.example

The agent wants to check your token.

Blocked · never reaches your shell **Read environment files**

.env and .env.*. Examples and templates are allowed.

```
⛔ context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team’s policy: Read environment files. .env files hold secrets.
… Tell the user it was blocked and continue with other work.
```

The model reads this refusal, not your keys.

Not a shell command: the agent's own Read tool.

Blocked · never runs **Read environment files**

File rules cover the agent's own Read, Edit, Grep and Glob tools too, not only the shell.

A Read call is rewritten into the same refusal.

The same read, inside a substitution.

Blocked · never reaches your shell **Read environment files**

Protect works out the substitution and reads it as cat .env.

```
cat $(echo .env)
cat `echo .env`
cat $(echo .e)nv
all read as: cat .env
```

No file at all: the agent dumps the environment.

Blocked · never reaches your shell **Dump the environment**

env, printenv, export -p, a bare set, /proc/<pid>/environ, and commands that read stored secrets.

Keys outside the repo.

Blocked · never reaches your shell **Read credential files**

~/.ssh, ~/.aws, ~/.kube, ~/.npmrc, ~/.git-credentials, *.pem, *.key and more.

The template the agent needs to set up the app.

Runs **No rule matches**

.env.example, .env.sample and .env.template hold no secrets, so they run.

The problem

## One read sends your keys. *You do not see it happen.*

**The agent runs commands without asking**

That is why it is fast. A `cat .env` to "check the token" looks like normal work.

**What it reads goes to the model**

The file's text becomes a tool result, and the agent sends it to the model with the rest of the conversation.

**There is more than one way in**

The shell, the agent's own Read tool, a read inside a substitution, or `printenv`. A check on one tool name misses the rest.

How it works

## Checked on the gateway. *Refused before it runs.*

1. 01 **Turn on the secrets pack** Open Protect in the console and pick Balanced or Locked down. Both include Protect secrets and also turn on [Core protections](https://context-mode.com/docs/protect#core-protections).
2. 02 **Protect reads each call** It reads what the call does, through wrappers such as `sudo` and `sh -c`, in the shell and in the agent's file tools.
3. 03 **The client runs a refusal instead** The gateway turns a blocked call into an echo of the refusal. The model reads the rule and why, and the agent carries on with other work.

**Your agent**Asks to run `cat .env` to check a token.

→

**Context Mode · Protect**Checks the call before the client runs it.

- Matches "Read environment files"
- Turns the call into an echo of the refusal
- Writes the block to the decision log, with no file contents

→

**The model**Reads the refusal and why. It never reads your keys.

Your agent asks for the read. Protect, in blue, refuses it on the gateway. The file never opens, so nothing from it reaches the model.

Proof

## Tested on production. *Tried in real sessions.*

**42** of the test cases try to get past the rules, such as `cat $(echo .env)`

**Every run** blocked the `.env` read and never showed the token, on Claude Opus 5.5 and Claude Haiku 4.5

### What the secrets pack blocks

| Rule | Blocks | Still runs |
| --- | --- | --- |
| Read environment files | `.env` and `.env.*` | `.env.example` , `.env.sample` , `.env.template` |
| Read credential files | `~/.ssh` , `~/.aws` , `~/.kube` , `~/.npmrc` , `~/.git-credentials` , `*.pem` , `*.key` and more | Other files in your home folder |
| Dump the environment | `env` , `printenv` , `export -p` , a bare `set` , and commands that read stored secrets | `env FOO=1 npm test` |
| Upload files | `curl -F` , `-T` , `-d @file` ; `wget --post-file` ; `gh gist create` and more | `curl -d '{}'` to an API |
| Known paste and drop sites | 19 hosts, such as pastebin.com and webhook.site | Other sites, unless you block them |

The live runs are prompt 2 of the Protect docs' 5-minute trial, run on 2026-10-02 and 2026-10-04 in real sessions through the gateway. Limits: without "block other sites", the pack slows a leak and does not stop it. A program that picks its destination at run time, or a script file Protect cannot read, can get past it. [Method and sources →](https://context-mode.com/docs/protect#try-it)

Products used

## What this *uses.*

**[Protect](https://context-mode.com/protect)**

Rules for every tool call, checked before your client runs it. In every plan; off until you turn it on.

**[Protect docs](https://context-mode.com/docs/protect)**

Every rule in the secrets pack, the refusal text, and the limits.

**[The test report](https://context-mode.com/blog/protect-rules-for-coding-agents)**

How we tried to get past the rules, and the 126 checks.

**[Plans](https://context-mode.com/pricing)**

Start free. On Team, one policy covers every member, and an agent cannot loosen it.

Related: [Secure coding agents](https://context-mode.com/solutions/secure-coding-agents) · [For security teams](https://context-mode.com/solutions/security-teams)

## Keep your keys *out of the model.*

*npx @context-mode/cli* connects your agents. 1,000 requests free, no card.

[Get started free →](https://console.context-mode.com/login) [Read the docs →](https://context-mode.com/docs/protect#pack-secrets)