Codex should never read or print environment variables

Resolved 💬 3 comments Opened Mar 3, 2026 by karthikp32 Closed Mar 3, 2026

💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

No description provided.

View original on GitHub ↗

3 Comments

etraut-openai contributor · 5 months ago

Can you provide more details?

I'm guessing that you're referring to sandboxed environments that Codex creates when running tools.

Please refer to this documentation for details about the shell environment policy configuration knobs provided by Codex.

karthikp32 · 5 months ago

Yes, Codex read my .env file and env variables with SECRET in the name. I don't want to those secrets or API keys to be spit out by ChatGPT or Codex to another user

etraut-openai contributor · 5 months ago

An .env file is different from environment variables. If you have an .env file in your project directory, then it's readable. That's by design, so not something we'd consider a bug.

There is a feature request for excluding sensitive files. If you'd like to see that, please upvote that issue.