Blog.
Notes on API keys, .env files and AI coding agents, from the people who make fidelius.
Can Claude Code read your .env file?
Yes, and it doesn't need to ask. What deny rules block, what they miss, why .claudeignore does nothing, and how to keep keys out of the file altogether.
Keep secrets from Claude Code, Codex and Gemini CLI
What Claude Code, Codex and Gemini CLI read by default, from .env files to inherited environment variables, what to change in each, and one setup for all three.
Where should MCP server API keys live?
Most MCP setup guides paste API keys into JSON. How Claude Code, Cursor, Claude Desktop and Codex handle server keys, and how to keep them out of config files.