›_ Codex Issues
Codex Issues / #13778

Codex reading files like .env!

Open 💬 7 comments Opened Mar 6, 2026 by kriss145
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.305.950 (863)

What subscription do you have?

Pro

What platform is your computer?

Darwin 25.3.0 arm64 arm

What issue are you seeing?

Problem

Codex can read .env files inside the workspace (e.g. via cat .env) without any denylist or explicit confirmation. The file contents then become part of the conversation context, which means secrets can be exposed.

Steps to Reproduce

  1. Open a project containing .env in the workspace.
  2. Ask Codex to check environment variables or run cat .env.
  3. Observe that .env contents appear in the conversation context.

Expected Behavior

  • Built‑in denylist (e.g. .env, .env.*, **/secrets/**).
  • Explicit confirmation before reading files likely to contain secrets.
  • Optional user-configurable allow/deny lists.

Actual Behavior

  • No denylist or safeguard.
  • .env can be read without explicit user consent.

Impact

  • Real risk of secret exposure.
  • Forces users to move secrets outside the repo, which complicates local workflows.

Environment

  • App: Codex Desktop
  • Version: [fill in]
  • OS: [e.g. macOS 14.5]
  • Date: [e.g. 2026‑03‑06]

Additional Notes

Please confirm whether a denylist for .env files is planned and provide an ETA if possible.

What steps can reproduce the bug?

Just try create something in your folder where .env is.
Model reading the file!

What is the expected behavior?

_No response_

Additional information

_No response_

View original on GitHub ↗

7 Comments

github-actions[bot] contributor · 5 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #12454

Powered by Codex Action

franchesoni · 5 months ago

codex reading .env is great
at least with full permissions
maybe a .codexignore ?
anyways not a bug

kriss145 · 5 months ago

In the Codex App I have default permissions, not full.
I have not there .codexignore - now I added but still.. Codex App can read!

To be honest it should be blocked as default! Many users using the Codex app, Cursor or another.

TheBit · 5 months ago

Just tried this in Cursor/Auto :)

<img width="886" height="857" alt="Image" src="https://github.com/user-attachments/assets/64e8e7eb-2a1b-45f9-bb35-ee8f7feaaa36" />

kriss145 · 5 months ago

Like I see - don't work :)

ict-nagao · 4 months ago

I can reproduce a very similar issue on Codex Desktop for Windows with WSL sandbox enabled.

Important detail: my ~/.codex/config.toml is definitely being loaded, because changing sandbox_mode from workspace-write to read-only is reflected in the app.

However, even with explicit deny rules for .env files in:

[permissions.locked.filesystem]
":project_roots" = {
"." = "read",
"/.env" = "none",
"/.env.*" = "none",
"**/*.env" = "none"
}

Codex still read .env using:

sed -n '1,200p' .env

So this seems less like a config loading issue, and more like filesystem deny rules not being enforced correctly in the Desktop app / WSL environment.

shleder · 2 hours ago

Regarding the risk of Codex reading .env / secret files into context:

Application-level denylists inside the LLM prompt can still fail on indirect tool calls, bash subshells (cat $(echo .env)), or child processes.

If you need guaranteed, kernel-enforced protection on macOS and Linux without moving secrets out of your repository, you can wrap Codex with Vetto:

# 1. Quick run via npm without setup:
npx @shledery/vetto --agent codex -- codex

# Or via native package:
vetto --agent codex --profile strict -- codex

How Vetto prevents .env and secret exposure:

  • VFS Path Masking: Sensitive files (.env, .env.*, ~/.ssh/*, ~/.aws/*) are mapped directly to /dev/null at the OS layer (via Linux Landlock / macOS Seatbelt) before spawning the process.
  • Fail-Closed Guarantee: Any tool or shell command attempting to read .env immediately receives 0 bytes / EOF, making it physically impossible for the model or subagents to ingest the contents into context.
  • PTY Secret Redactor: Scans live terminal stdout in real-time with an Aho-Corasick + Shannon entropy filter to mask high-entropy tokens (sk-proj-..., ghp_...) before they are printed or saved to transcripts.