Why .gitignore and .claudeignore do not hide a secret

The intuitive fix, when you realise an agent can read your project, is to add the file to an ignore list. It feels like a lock. People then run agents for months believing a line in .gitignore is keeping their production keys away from a model provider.

It helps to be precise about what each one was built for. .gitignore tells git what not to track, and it was never a security control; a file listed there is still sitting in your working directory, readable by every process you run. .claudeignore is a newer convention aimed at one agent, and The Register reported in January 2026 that Claude Code read .env files regardless of it. A memory rule, a line in CLAUDE.md telling the agent never to open that file, is the same kind of request aimed at judgment instead of access, and it fails the same way: Anthropic's own issue tracker carries reports of Claude Code reading a .env file with exactly that instruction in place. Even a perfectly honoured ignore file only covers the tool that reads it, so the next agent you install starts from scratch. The distinction worth internalising is between asking and being unable: a secret still in the file is protected by a promise, and a secret that was never in the file is protected by not being there. Only the second one survives a tool changing its behaviour in an update you did not read.

How it works

1. 1Keep using .gitignore. It stops a secret reaching your repository history, which is a different and real problem.
2. 2Stop treating either file as access control. Neither removes the value from a directory the agent can read.
3. 3Move the value out of the project. In Forkbench that means Vault, where the secret stays on your machine and reaches only the command that needs it.
4. 4Leave a .env with placeholder names if your tooling expects the file to exist. A file full of variable names and no values is harmless to read.

Straight about the guarantee: Nothing here is a criticism of any single agent. Every agent that runs in your terminal has your filesystem access by design, because that is what makes it useful. The point is that a convention cannot be the thing standing between an agent and a production credential.