Repository navigation
Session accessing .env file without asking the user. Curious what is the default behavior to prevent reading .env files and the likes of it. #4308
Description
Question
I was testing OpenCode on a test LibreChat project, and I noticed that it reads the project's .env file without any warning, nor asking the user to allow it.
OpenCode is in Plan mode (Plan Agent).
.env is in LibreChat's .gitignore as well, so what happened?
.gitignore:
### node etc ###
# Logs
data-node
meili_data*
data/
logs
*.log
# Runtime data
pids
*.pid
*.seed
.git
# CI/CD data
test-image*
# Directory for instrumented libs generated by jscoverage/JSCover
lib-cov
# Coverage directory used by tools like istanbul
coverage
# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
.grunt
# translation services
config/translations/stores/*
client/src/localization/languages/*_missing_keys.json
# Compiled Dirs (http://nodejs.org/api/addons.html)
build/
dist/
public/main.js
public/main.js.map
public/main.js.LICENSE.txt
client/public/images/
client/public/main.js
client/public/main.js.map
client/public/main.js.LICENSE.txt
# Azure Blob Storage Emulator (Azurite)
__azurite**
__blobstorage__/**/*
# Dependency directorys
# Deployed apps should consider commenting these lines out:
# see https://npmjs.org/doc/faq.html#Should-I-check-my-node_modules-folder-into-git
node_modules/
meili_data/
api/node_modules/
client/node_modules/
bower_components/
*.d.ts
!vite-env.d.ts
# AI
.clineignore
.cursor
.aider*
# Floobits
.floo
.floobit
.floo
.flooignore
#config file
librechat.yaml
librechat.yml
# Environment
.npmrc
.env*
my.secrets
!**/.env.example
!**/.env.test.example
cache.json
api/data/
owner.yml
archive
.vscode/settings.json
src/style - official.css
/e2e/specs/.test-results/
/e2e/playwright-report/
/playwright/.cache/
.DS_Store
*.code-workspace
.idx
monospace.json
.idea
*.iml
*.pem
config.local.ts
**/storageState.json
junit.xml
**/.venv/
**/venv/
# docker override file
docker-compose.override.yaml
docker-compose.override.yml
# meilisearch
meilisearch
meilisearch.exe
data.ms/*
auth.json
/packages/ux-shared/
/images
!client/src/components/Nav/SettingsTabs/Data/
# User uploads
uploads/
# owner
release/
# Helm
helm/librechat/Chart.lock
helm/**/charts/
helm/**/.values.yaml
!/client/src/@types/i18next.d.ts
# SAML Idp cert
*.cert
# AI Assistants
/.claude/
/.cursor/
/.copilot/
/.aider/
/.openai/
/.tabnine/
/.codeium
*.local.md
Curious what is the default behavior for the likes of .env files? By default, the agent should never read those files unless explicitly allowed, right?
Activity
github-actions commentedon Nov 13, 2025
This issue might be a duplicate of existing issues. Please check:
Feel free to ignore if none of these address your specific case.
raymelon commentedon Nov 13, 2025
Cool! However, it is concerning that a tool like OpenCode needs a third-party plugin to have a critical functionality like this — such as preventing a known secret store such as
.envfiles from being accessed entirely by OpenCode.From #539 (comment):
Curious about the deeper decisions behind leaving this functionality unimplemented within OpenCode.
rekram1-node commentedon Nov 14, 2025
i brought this up before i joined the team a while ago
im making it deny reads to .envs going forward it makes more sense
redtux commentedon Nov 14, 2025
It doesn't just read it, it also overwrites it, cries when realizing its mistake, and kindly apologizes. 🤭 Had the same issue yesterday.
rekram1-node commentedon Nov 14, 2025
fixed in next release: 4c2e888
pjmartos commentedon Dec 2, 2025
Hi team,
I've built a plugin to support excluding sensitive content from the agent's reach: https://github.com/pjmartos/opencode-leak-proof
It honours
.aiexcludefiles at various locations as well as project-root.gitignorefiles (.gitignorefiles in subfolders are still not supported).It's still in kind of an experimental phase, but early results are encouraging.
I would greatly appreciate any feedback you may have.
Cheers.