Agent can read and leak .env credentials into .squad/ committed files

Summary

A spawned agent (investigation/diagnosis task) read the project's .env file and wrote the live database connection string — including the password — verbatim into .squad/decisions/inbox/. Scribe then committed and pushed that file to the remote repository.

The credential was publicly exposed in git history until manually purged (I was never reviewing these md changes).

Steps to Reproduce

Ask an agent to diagnose a database/infrastructure issue
Agent reads .env to gather connection details for its analysis
Agent writes findings (including raw connection string) to .squad/decisions/inbox/
Scribe commits and pushes the inbox file
Credential is now in git history

Root Cause

No guardrails prevent agents from:

Reading .env files (only .env.example should ever be read)
Writing credential-shaped strings into .squad/ files before committing

Impact

High. Any agent with filesystem access + a diagnosis/audit task can inadvertently leak production secrets into the committed .squad/ memory layer. The Scribe's auto-commit amplifies the blast radius by pushing immediately.

Proposed Fixes

1. Agent charter prohibition (immediate)
Add to all agent charters:

❌ NEVER read .env files. Only .env.example is permitted.
If you need DB/infra config, ask the user or read .env.example.

2. Content filter before Scribe commits (short-term)
Add a pre-commit scan in Scribe's workflow that detects credential patterns (connection strings, passwords, API keys) and redacts or blocks the commit.

Affected Versions

Squad v0.5.4 (coordinator) — agent charters have no .env read prohibition.

GitGuardian alerted.

This is a good catch and neccessary hardening exercise - I will have Baer and the other agents review this and come up with a comprehensive proposal. Sit tight.

Performed a scan of my own logs and conversations, too, which have juggled a few NPM secrets early on. I am happy to say we found none, but, Baer is working up a PRD to mitigate.

@lbouriez

Response to Issue #267: Agent Credential Leak

@lbouriez — Thank you for this responsible disclosure. This is a real finding, and we appreciate you reporting it.

Severity Acknowledgement

You're absolutely right: this is a legitimate credential leak vector. A spawned agent read .env, extracted live database credentials, wrote them to .squad/decisions/inbox/, and Scribe auto-committed and pushed them to the remote. The credential lived in public git history until GitGuardian caught it.

Your core insight—"hooks are code, prompts can be ignored"—is exactly correct. Our existing defense relied on prompt-level warnings with no code enforcement. That's insufficient.

Audit Status: Clean

We've completed a comprehensive security audit:

330 files scanned in .squad/ directory
100+ deleted files examined in git history
Full git log searched for 15+ credential patterns

Result: ✅ No leaked secrets found. All credential-related content was documentation, examples, or environment variable placeholders. No rotation or remediation required.

Remediation Plan

We've synthesized input from our security, architecture, and implementation teams into a three-phase defense-in-depth strategy. This combines prompt hardening, code-enforced hooks, and pre-commit scanning.

Phase 1: Immediate Fixes (This Release)

These are prompt-level and charter-level hardening measures that deploy immediately:

1.1 Spawn Template Hardening

All agents—including Scribe—now receive explicit security rules on spawn:

NEVER read .env* files (except .env.example, .env.sample, .env.template)
NEVER write secrets, credentials, tokens, API keys, passwords, or connection strings to .squad/ files
IF config info is needed → ask the user OR read .env.example

This applies to the generic agent spawn template and Scribe's pre-commit workflow.

1.2 Security Skill Documentation

We've created .squad/skills/secret-handling/SKILL.md—a canonical reference for all agents:

Prohibited file patterns (.env, .npmrc, id_rsa, *.pem, appsettings.json, etc.)
Allowed alternatives (.env.example, placeholder syntax)
Secret detection patterns (connection strings, tokens, API keys, passwords, private keys)
Remediation steps if secrets are detected

All agents reference this skill before reading files or writing to .squad/.

1.3 Agent Charter Security Sections

Every agent charter now includes a standard Security section:

## Security

- Never read `.env*` files (except `.env.example`, `.env.sample`)
- Never write secrets, credentials, or PII to `.squad/` files
- See `.squad/skills/secret-handling/SKILL.md` for full rules

This makes security rules scannable and enforceable during agent spawns.

1.4 Scribe Pre-Commit Validation

Scribe's charter now includes a pre-commit scanning step. Before calling git commit, Scribe:

Scans ALL staged .squad/ files for secret patterns (API keys, passwords, connection strings, JWT tokens, private keys, AWS credentials)
If secrets detected → STOP, unstage the file, report to user with file path and pattern, exit with error
NEVER auto-commits secrets — blocking the commit is correct behavior

Phase 2: Code Enforcement (Short-Term)

These are hook-based defenses that execute deterministically—not dependent on prompt compliance.

2.1 PreToolUseHook: `.env` File Read Blocker

Blocks agent reads of environment files at the tool-call level:

Blocked patterns: .env, .env.local, .env.production, .env.staging, .env.development, .env.test
Allowed patterns: .env.example, .env.sample, .env.template
Tool interception: view, read_file, get_file_contents, and shell commands (cat .env, type .env, Get-Content .env)

Detection logic: Regex-based path matching on file read tools, shell command pattern detection for .env reads.

Configuration: Enabled by default via PolicyConfig.blockEnvFileReads: true (opt-out available).

2.2 PostToolUseHook: Enhanced Secret Content Scrubber

Extends the existing PII scrubber to detect and redact 15+ credential patterns in tool outputs:

Connection strings:

MongoDB (mongodb://, mongodb+srv://)
PostgreSQL (postgres://, postgresql://)
MySQL (mysql://)
Redis (redis://)
AMQP (amqp://, amqps://)

Tokens and keys:

GitHub tokens (ghp_*, gho_*, github_pat_*)
API keys (sk-*, AKIA*, AIza*, Stripe keys)
Bearer tokens (Bearer ...)
JWT tokens (3-segment base64 patterns)

Config-style secrets:

Password assignments (password=, passwd=, pwd=, secret=)
Azure connection strings (AccountName=...;AccountKey=...)
Long base64 strings in config contexts (min 32 chars)

Action: Redact matched content as [{LABEL}_REDACTED] instead of blocking entirely.

Configuration: Enabled by default via PolicyConfig.scrubSecrets: true (opt-out available).

2.3 Scribe Pre-Commit Scanner: `scanForSecrets()`

A new SDK function (packages/squad-sdk/src/hooks/secret-scanner.ts) that Scribe calls before git add .squad/:

export async function scanForSecrets(filePaths: string[]): Promise<SecretScanResult>;

Returns:

detected: boolean — True if secrets were found
flaggedFiles — List of files with matches, including pattern name, line number, and snippet

Usage pattern: Scribe scans all files before staging. If secrets are detected, Scribe blocks the commit and reports locations to the user.

2.4 PolicyConfig Extensions

export interface PolicyConfig {
  /** Enable secret scrubbing on tool outputs (default: true) */
  scrubSecrets?: boolean;
  
  /** Block reads of .env files (default: true) */
  blockEnvFileReads?: boolean;
}

Backward-compatible: existing scrubPii flag maps to scrubSecrets.

Phase 3: Future Hardening (Backlog)

Long-term enhancements for smarter detection and broader coverage:

3.1 CI-Level Secret Scanning

Integrate gitleaks or truffleHog into GitHub Actions workflow:

Automated detection on every commit
Block merges if secrets are detected
Configurable pattern exclusions for false positives

3.2 Git Pre-Commit Hook (Local Development)

Distribute .squad/git-hooks/pre-commit via squad init command:

Shell script that runs secret scanning before commits
OS-level enforcement (executes even if agent ignores charter)
Symlinked from .git/hooks/pre-commit

3.3 Entropy-Based Detection

Reduce reliance on pattern matching:

Flag high-entropy strings (e.g., base64 blobs >32 chars)
Lower false positive rate for proprietary secret formats

3.4 Integration with Secret Managers

Teach agents to reference secrets via placeholder syntax:

Example: {{secrets.DATABASE_URL}} → agent never sees actual value
Requires integration with HashiCorp Vault, Azure Key Vault, or AWS Secrets Manager

Why Hooks Over Prompts?

You called it out perfectly: prompts can be ignored, hooks are code.

Our Phase 1 fixes (prompts, charters, skills) are the first line of defense—they reduce false positives and set expectations. But they're not foolproof.

Our Phase 2 fixes (hooks) are code-enforced:

PreToolUseHook blocks .env reads before the tool executes
PostToolUseHook scrubs secrets before the agent sees the output
scanForSecrets() blocks commits before Scribe stages files

These hooks execute deterministically. They don't rely on agent compliance—they enforce policy at the SDK level.

Testing Coverage

Our test engineering team (Hockney) is writing comprehensive tests for all layers:

Unit tests: .env read blocker (direct file reads + shell commands)
Unit tests: Secret scrubber (all 15+ pattern types)
Integration tests:
- Agent attempts .env read → blocked
- Agent outputs connection string → redacted
- Scribe pre-commit scan detects leaked token → commit blocked
Backward compatibility tests: scrubPii: true still works

Expected coverage: 30+ test cases across unit and integration levels.

Timeline

Phase 1 (Immediate): Deploying in this release (spawn templates, charters, skills, Scribe pre-commit validation)
Phase 2 (Short-term): 1-2 weeks (hook implementation, SDK integration, testing)
Phase 3 (Future): Backlog (CI integration, git hooks, entropy detection)

Affected Versions

Vulnerable: All versions prior to this release that allowed .env file reads without enforcement
Fixed: This release (Phase 1 prompt hardening) + upcoming Phase 2 release (hook enforcement)

Documentation

We're updating:

docs/security.md — Hook capabilities, secret patterns, opt-out configurations
.squad/skills/secret-handling/SKILL.md — Canonical agent reference for secret handling
Agent charter templates — Standard Security sections for all agents
Migration guide — scrubPii → scrubSecrets transition

Success Criteria

✅ Zero credential leaks — No secrets committed to .squad/ for 6 months
✅ Low false positive rate — <5% of legitimate writes blocked
✅ Fast execution — Secret scanning adds <100ms per file write
✅ Auditable — All blocks logged with pattern name and file path
✅ Documented — Skill doc exists explaining patterns and override process

Thank You

This was a high-quality report with a valid insight. You helped us strengthen Squad's security posture. We've audited our logs (clean), hardened our prompts (Phase 1), and designed code-enforced hooks (Phase 2) to prevent recurrence.

If you have any questions or feedback on this remediation plan, please let us know.

— Baer (Security), on behalf of the Squad team

📋 Assigned to Fenster (Core Dev)

Issue: #267 — Agent can read and leak .env credentials into .squad/ committed files

Fenster will pick this up in the next Copilot session.

For Copilot coding agent: If enabled, this issue will be worked automatically.
Otherwise, start a Copilot session and say:
Fenster, work on issue #267

📋 Assigned to Baer (Security)

Issue: #267 — Agent can read and leak .env credentials into .squad/ committed files

Baer will pick this up in the next Copilot session.

For Copilot coding agent: If enabled, this issue will be worked automatically.
Otherwise, start a Copilot session and say:
Baer, work on issue #267

🏗️ Squad Triage — Keaton (Lead)

Issue: #267 — Agent can read and leak .env credentials into .squad/ committed files
Assigned to: Hockney (Tester)
Reason: Issue relates to testing/quality work

@copilot evaluation: 🔴 Not suitable — issue involves work outside the coding agent's capability profile.

Team roster:

Keaton (Lead) → label: squad:keaton
Verbal (Prompt Engineer) → label: squad:verbal
Fenster (Core Dev) → label: squad:fenster
Hockney (Tester) → label: squad:hockney
McManus (DevRel) → label: squad:mcmanus
Kujan (SDK Expert) → label: squad:kujan
Edie (TypeScript Engineer) → label: squad:edie
Trejo (Release Manager) → label: squad:trejo
Drucker (CI/CD Engineer) → label: squad:drucker
Fortier (Node.js Runtime) → label: squad:fortier
Rabin (Distribution) → label: squad:rabin
Baer (Security) → label: squad:baer
Redfoot (Graphic Designer) → label: squad:redfoot
Strausz (VS Code Extension) → label: squad:strausz
Saul (Aspire & Observability) → label: squad:saul
Kovash (REPL & Interactive Shell) → label: squad:kovash
Marquez (CLI UX Designer) → label: squad:marquez
Cheritto (TUI Engineer) → label: squad:cheritto
Breedan (E2E Test Engineer) → label: squad:breedan
Nate (Accessibility Reviewer) → label: squad:nate
Waingro (Product Dogfooder) → label: squad:waingro
Ralph (Work Monitor) → label: squad:ralph
@copilot (Coding Agent) → label: squad:copilot

To reassign, remove the current squad:* label and add the correct one.

docs(ai-team): Merge 13 decisions from 9-agent secret guardrails sprint

docs(squad): harden release team charters + retro + security tests

fix(cli): ESM runtime patch + secret guardrails sprint (#265, #267) (#…

Phase 1 shipped in PR #268 (merged to main as `bd6de49`)

✅ Secret-handling skill created (.squad/skills/secret-handling/SKILL.md)
✅ Prompt-level guardrails prohibiting credential handling
✅ 59 TDD tests (16 passing, 46 .todo\ for Phase 2 hooks)
✅ Security audit of .squad/\ logs — all clean, no leaked credentials
✅ Charter hardening for release team (branch-first, triage-gates)
✅ 13+ decisions captured in .squad/decisions.md\

Phase 2 (runtime hooks: .env blocker, secret scrubber, pre-commit scanner) will be tracked as a separate issue when ready. The 46 .todo\ tests in \ est/hooks-security.test.ts\ serve as the implementation roadmap.

feat: OTel public API export, integration tests, REPL wiring, upstrea…

Merge pull request github#308 from bradygaster/squad/wave1-remaining

docs: production security hardening — threat model, prompt injection …

Agent can read and leak .env credentials into .squad/ committed files #267

Description

Summary

Steps to Reproduce

Root Cause

Impact

Proposed Fixes

Affected Versions

Activity

bradygaster commented on Mar 8, 2026

bradygaster commented on Mar 8, 2026

bradygaster commented on Mar 8, 2026

Response to Issue #267: Agent Credential Leak

Severity Acknowledgement

Audit Status: Clean

Remediation Plan

Phase 1: Immediate Fixes (This Release)

1.1 Spawn Template Hardening

1.2 Security Skill Documentation

1.3 Agent Charter Security Sections

1.4 Scribe Pre-Commit Validation

Phase 2: Code Enforcement (Short-Term)

2.1 PreToolUseHook: .env File Read Blocker

2.2 PostToolUseHook: Enhanced Secret Content Scrubber

2.3 Scribe Pre-Commit Scanner: scanForSecrets()

2.4 PolicyConfig Extensions

Phase 3: Future Hardening (Backlog)

3.1 CI-Level Secret Scanning

3.2 Git Pre-Commit Hook (Local Development)

3.3 Entropy-Based Detection

3.4 Integration with Secret Managers

Why Hooks Over Prompts?

Testing Coverage

Timeline

Affected Versions

Documentation

Success Criteria

Thank You

github-actions commented on Mar 8, 2026

📋 Assigned to Fenster (Core Dev)

github-actions commented on Mar 8, 2026

📋 Assigned to Baer (Security)

github-actions commented on Mar 8, 2026

🏗️ Squad Triage — Keaton (Lead)

@copilot evaluation: 🔴 Not suitable — issue involves work outside the coding agent's capability profile.

bradygaster commented on Mar 8, 2026

Phase 1 shipped in PR #268 (merged to main as bd6de49)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

2.1 PreToolUseHook: `.env` File Read Blocker

2.3 Scribe Pre-Commit Scanner: `scanForSecrets()`

Phase 1 shipped in PR #268 (merged to main as `bd6de49`)