AI Agent Secret Leak & Ephemeral Key Checklist
A 15-minute credential-safety worksheet for preventing AI coding agents, MCP tools, browser agents, and workflow agents from seeing, logging, or misusing raw secrets.
Map leak paths
Env files, shell profiles, CI variables, MCP configs, browser sessions, logs, and transcripts.
Use ephemeral keys
PR-scoped, repo-scoped, staging-only, read-only, short-lived, or owner-approved credentials.
Prove the boundary
Canary secret drill, blocked-path test, log-redaction check, and revocation record.
Why this matters now
HN and GitHub signals on 2026-06-12 pointed to PR-scoped ephemeral keys, agents bankrupting operators through uncontrolled actions, agent-owned computers, ShieldMCP, Claude Code secret hooks, agent sandboxes with redaction, MCP risk scanners, and vault-style credential references.
15-minute secret boundary map
| Secret class | Where it appears | Agent default | Safer replacement |
|---|---|---|---|
| Cloud/API deploy token | .env, shell env, CI, configs | Deny raw value | Scoped ephemeral token |
| Git/provider token | remotes, package publishing, issue bots | Deny raw value | PR/repo-scoped key |
| Payment/refund key | Stripe, Gumroad, billing tools | Human-gated only | Approval proxy/read-only reporting |
| MCP server credential | server config, local JSON, env vars | Deny raw value | Brokered vault reference |
Ephemeral key policy
| Risk tier | Agent job | Credential pattern | Expiry |
|---|---|---|---|
| Tier 0 | Research/drafting | No credentials | n/a |
| Tier 1 | Repo read + local tests | Read-only repo or fixture token | Same day |
| Tier 2 | PR-limited edits/build | PR/repo-scoped key | 1-4 hours |
| Tier 3 | Staging API calls | Staging-only key, rate caps | 15-60 minutes |
| Tier 4 | Deploy/refund/payment/export | No autonomous raw key | Single action |
Core checklist
- Inventory every place agent-readable secrets can appear.
- Replace permanent keys with scoped, ephemeral, read-only, staging-only, or brokered references.
- Block env dumps, home-directory credential browsing, raw MCP config exposure, and browser-cookie export.
- Run a canary secret drill plus blocked-path and log-redaction tests.
- Expire credentials after the run and keep revocation commands outside the agent session.
Secret-ready agent run record
Agent/tool: Owner: Task: Data/repo scope: Credential pattern used: Expiry time: Explicit denials: Human-gated actions: Canary/leak test result: Log redaction result: Revocation command/location: Evidence packet link: Next review date:
Turn this into an agent credential-control sprint.
Pair this checklist with the OperatorForge AI bonuses for sandboxing, local firewalls, MCP security, authorization boundaries, observability, rollback, verification, instruction governance, skill security, and spend controls.