Repository navigation
[FEATURE]: Protect .env files in grep/glob results, not just direct read #17073
Description
Feature hasn't been suggested before.
- I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
Problem
Permission rules for grep and glob match the search pattern, not the matched file path. So this config:
"grep": { "*.env": "ask" },
"glob": { "*.env": "ask" },
"read": { "*.env": "ask" }protects direct read calls, but does NOT protect against indirect exposure via grep "SOME_KEY" ., which can still return sensitive matches from .env without ever naming it.
Repro
- Add
TEST_DB_URL=sensitive-valueto.env - Use the config above
- Run:
grep "TEST_DB_URL" . - OpenCode still returns matches from
.env
Expected
Blocked files should be filtered from grep and glob results before the model sees them, the same way direct read protection works.
Prior art
opencode-env-protectredacts env values from tool output after execution (The redaction part happens ontool.execute.after, where it replaces sensitive values in tool outputs before the AI sees them.)opencode-ignorealready claims to filter blocked files fromgrep/globresults
Both plugins prove this is achievable natively.
Request
- Make
grep/globfilter results by matched file path, not just the query pattern - Or add built-in secret file protection for
.env, private keys, and credential files - At minimum, document that
readpath rules do NOT covergrep/glob
Related: #539
Reacted by TheRoboxx, Tomasz Boguszewski, lyc2333, Stefan-Bachmann, Martin Braun, xenion1987 and Mac Moneysac
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Mar 11, 2026
This issue might be a duplicate of existing issues. Please check:
.envsecrets from being transmitted to LLMs (Zero-Trust Secret Protection)readbypasses.gitignorewhilegrep/globrespect itNote: #539 (which you already reference) is the original security request that was closed — the concerns raised there appear to still be partially unresolved based on #12196 and this issue.
abysslover commentedon May 13, 2026
Surprisingly... how this could happen...
Grelo4ka commentedon Jun 15, 2026
this feature is much needed
theRoboxx commentedon Jun 22, 2026
Agree. Better secret management and security is a much needed feature!
Mac-Moneysac commentedon Jul 21, 2026
For me, this feature would be quite nice. Especially, if this would be also true for non-env files that are denied by permission.
martin-braun commentedon Aug 12, 2026
grep/webfetch/websearchall enabled makes me nervous about prompt injections due to this issue ..github-actions commentedon Oct 13, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.
Grelo4ka commentedon Oct 14, 2026
That's very unfortunate that these issues get closed automatically although just 2 weeks ago the same issue was referenced in another one which was marked as a duplicate