# hasp > Local secret broker for coding-agent and app workflows. Docs root: https://gethasp.com/docs/ Guides root: https://gethasp.com/guides/ Version: 1.0.39 GitHub: https://github.com/gethasp/hasp Changelog: /docs/changelog/ ## Recommended Reading ### Start - [Overview](https://gethasp.com/docs/overview/): What HASP is, what ships in the public repo, and how the local broker keeps secrets out of coding-agent context while still letting tools run. - [Mental model](https://gethasp.com/docs/mental-model/): How to think about HASP: vaults, repo boundaries, consumers, grants, sessions, audit, and redaction, and how the pieces fit into one model. - [Agent mental model](https://gethasp.com/docs/agent-mental-model/): How coding agents use HASP handles, MCP tools, grants, and brokered runs to get real work done without ever reading a raw secret value. - [Value-free manifests](https://gethasp.com/docs/value-free-manifests/): The committed .hasp.manifest.json contract that declares requirements, targets, examples, delivery, and safety rules without storing any secret. - [Quickstart](https://gethasp.com/docs/quickstart/): The shortest safe path to a working local HASP install: set up the vault, capture a secret, bind a repo, and prove one brokered run end to end. - [Install](https://gethasp.com/docs/install/): Install, upgrade, and uninstall HASP through Homebrew, plus packaged release downloads and building the broker from source on macOS and Linux. - [After Install](https://gethasp.com/docs/after-homebrew/): The common first-run path after installing HASP: initialize the vault, run setup, and confirm the daemon and keychain are working. ### Operate - [Command guide](https://gethasp.com/docs/command-guide/): What each HASP command does, when to reach for it, and how it compares to nearby commands, organized so you can find the right one fast. - [Operator Guide](https://gethasp.com/docs/operator-guide/): Environment variables, repo guardrails, audit logging, backup and restore, and the practices that keep a local HASP install safe to operate. - [Telemetry](https://gethasp.com/docs/telemetry/): How opt-in CLI telemetry works in HASP: what the payload contains, consent and retention rules, how to erase data, and the privacy guarantees. - [Repo targets](https://gethasp.com/docs/repo-targets/): Value-free repo requirements, target-scoped secret delivery, worked examples, and how app and MCP targets resolve inside a bound project. - [Credential sets](https://gethasp.com/docs/credential-sets/): Typed manifest sets for coupled credentials: atomic vault items, schema-checked roles, reviewed target delivery, and MCP-safe metadata. - [V1 production guide](https://gethasp.com/docs/v1-production-guide/): Run HASP in production: the local broker, OS keychain, background daemon, secret import, repo binding, and whole-program verification, end to end. ### Agents - [Agent Profiles](https://gethasp.com/docs/agent-profiles/): What a first-class agent profile guarantees, the expectations each one meets, and the generic broker path for agents without a profile. - [Codex CLI](https://gethasp.com/docs/agent-profiles/codex-cli/): Connect Codex CLI to HASP as a brokered MCP surface so it can run with project secrets without ever reading their plaintext values. - [Claude Code](https://gethasp.com/docs/agent-profiles/claude-code/): Connect Claude Code to HASP as a brokered MCP surface so it can use project secrets without ever reading their plaintext values. - [Cursor](https://gethasp.com/docs/agent-profiles/cursor/): Connect Cursor to HASP as a brokered MCP surface so the editor can run with project secrets without ever reading their plaintext values. - [Aider](https://gethasp.com/docs/agent-profiles/aider/): Connect Aider to HASP as a brokered MCP surface so the agent can run with project secrets without ever reading their plaintext values. - [Hermes](https://gethasp.com/docs/agent-profiles/hermes/): Connect Hermes to HASP as a brokered MCP surface so the agent can run with project secrets without ever reading their plaintext values. - [Pi (Inflection AI)](https://gethasp.com/docs/agent-profiles/pi/): Connect Pi to HASP through a generated package extension and brokered MCP surface, so it runs with project secrets without reading their values. - [OpenClaw](https://gethasp.com/docs/agent-profiles/openclaw/): Connect OpenClaw to HASP as a brokered MCP surface so the agent can run with project secrets without ever reading their plaintext values. - [Generic Broker Path](https://gethasp.com/docs/agent-profiles/generic/): Use HASP with any CLI- or MCP-capable agent that has no first-class profile yet, through the generic broker path that injects secrets safely. ### Release - [Changelog](https://gethasp.com/docs/changelog/): Public release notes for shipped HASP versions, with the changes, fixes, and security updates included in each tagged release. - [Release distribution](https://gethasp.com/docs/release-distribution/): How HASP releases are distributed: build assets, hosted mirrors, checksums, signatures, and the Homebrew formula update flow operators rely on. - [Install and release](https://gethasp.com/docs/install-and-release/): Operator-facing release verification and install details, including how to confirm checksums and signatures before trusting a HASP binary. ### Reference - [Glossary](https://gethasp.com/docs/glossary/): The HASP vocabulary used across CLI help, documentation, audit events, and error messages, defined in one place so terms stay consistent. - [CLI reference](https://gethasp.com/docs/cli-reference/): The exact help output generated by the installed hasp binary, covering every command, flag, and subcommand currently available. - [Errors](https://gethasp.com/docs/error-codes/): HASP error messages, stable exit-code buckets, JSON error codes, the hints they carry, and recovery guidance for each failure mode. ## Guides - [Keep secrets out of your Claude Code transcripts](https://gethasp.com/guides/claude-code-secrets-transcripts/): Claude Code transcripts capture every file read and command output. Five surfaces leak secrets; here is how brokering closes all of them, step by step. - [Best secrets management tools for AI developers](https://gethasp.com/guides/secrets-management-tools-ai-developers/): Eight secrets management tools scored on agent context exposure, injection model, offline operation, and setup friction, with a pick-X-if routing guide. - [HashiCorp Vault alternatives for solo developers](https://gethasp.com/guides/hashicorp-vault-alternatives-solo-developers/): HashiCorp Vault needs a server, a storage backend, and an unseal ceremony. Five lighter secrets tools for solo developers, with scenario routing for each. - [What is secrets management?](https://gethasp.com/guides/what-is-secrets-management/): Secrets management governs credentials from creation to revocation: encrypted storage, scoped delivery, rotation, and audit. A developer's definition. - [Least-privilege scopes for AI coding agents](https://gethasp.com/guides/least-privilege-scopes-for-coding-agents/): Your coding agent needs a few actions behind each credential, almost nothing else. A reference for the smallest scope each one can safely run on. - [Put your coding agent behind an egress allowlist](https://gethasp.com/guides/egress-allowlist-for-coding-agents/): A prompt injection can read your secrets but cannot exfiltrate them if the agent's outbound network is deny-by-default. How to build an egress allowlist. - [Your MCP config file is an attack surface](https://gethasp.com/guides/mcp-config-file-attack-surface/): An attacker who can write to your MCP config registers their own server and gets code execution at launch. CVE-2026-30615 proved it needs zero clicks. - [Hardening Windsurf and Cascade](https://gethasp.com/guides/hardening-windsurf-cascade/): Harden Windsurf and its Cascade agent: disable auto-execution, lock down MCP installs, exclude secrets from indexing, after CVE-2026-30615 and CVE-2025-62353. - [Agentjacking turns a Sentry error into code execution](https://gethasp.com/guides/agentjacking-sentry-mcp-coding-agents/): Attackers POST a fake Sentry error; the Sentry MCP server feeds it to Claude Code, Cursor, and Codex as trusted output, and the agents run their code. - [The AI coding agent CVE index for 2026](https://gethasp.com/guides/ai-coding-agent-cve-index/): A reference index of the real CVEs in Claude Code, Cursor, Copilot, and Gemini CLI: what each one does, which versions are affected, and what patches it. - [Stop your coding agent from printing secrets](https://gethasp.com/guides/redact-secrets-from-agent-output/): Coding agents print live secrets into tool output, which gets re-fed to the model, logged, and laundered into write paths. How to redact agent output. - [What the NSA's MCP security guidance actually requires](https://gethasp.com/guides/nsa-mcp-security-guidance/): The NSA's May 2026 MCP security sheet reads like a code review of your deployment. Its controls for logging, auth, data zones, and local-first, for developers. - [A stolen agent token should be useless](https://gethasp.com/guides/sender-constrained-tokens-for-ai-agents/): Short-lived and least-privilege tokens can still be replayed if stolen. Sender-constrained tokens bind the credential to the agent, so a leaked copy is inert. - [The leaked-secret incident runbook for AI agents](https://gethasp.com/guides/leaked-credential-incident-runbook/): Your AI coding agent committed an API key and the clock started in seconds. A runbook to revoke, rotate, purge, and audit a leaked secret before it's abused. - [Keep your Claude Code GitHub Action from leaking secrets](https://gethasp.com/guides/secure-claude-code-github-action/): Microsoft found Claude Code's GitHub Action could leak CI/CD secrets from /proc after one poisoned issue. The fix, the patched versions, and how to harden it. - [SSRF is the MCP bug that steals your cloud keys](https://gethasp.com/guides/ssrf-in-mcp-servers/): An MCP tool that fetches a URL it does not control can reach the cloud metadata endpoint and return live IAM credentials. The full SSRF chain and the fix. - [Authorize the action, not just the secret](https://gethasp.com/guides/authorize-the-action-not-just-the-secret/): A credential broker decides whether your agent should hold a key. It never decides whether the action should run. Pre-action authorization is the missing half. - [Secrets for coding agents: CLI skill vs MCP server](https://gethasp.com/guides/coding-agent-secret-kits-cli-vs-mcp/): Secrets vendors ship agent kits two ways: a CLI wrapper that injects credentials at exec, or an MCP server. Only one keeps the key out of the model's context. - [Vet VS Code extensions before your AI agent runs](https://gethasp.com/guides/harden-vs-code-extensions-for-coding-agents/): Two 2026 supply-chain attacks turned VS Code extensions into agent hijackers and credential stealers. Vet an extension before your AI agent inherits its reach. - [Mini Shai-Hulud hides inside your coding agent](https://gethasp.com/guides/mini-shai-hulud-worm-ai-coding-agents/): An npm worm planted a SessionStart hook in Claude Code so it reloads with the agent's full permissions after the bad package is gone. Mechanism and cleanup. - [OWASP's agentic Top 10, ranked by real risk](https://gethasp.com/guides/owasp-agentic-top-10-for-coding-agents/): The OWASP Top 10 for Agentic Applications 2026, read for one engineer running a coding agent: which risks leak your credentials and the minimum fix for each. - [Give your AI agent database access without the password](https://gethasp.com/guides/agent-database-access-without-password/): Stop putting DATABASE_URL in .env. Broker a scoped, short-lived database credential at runtime so the agent can query without ever holding the password. - [Put a credential proxy in front of your coding agent](https://gethasp.com/guides/credential-proxy-for-coding-agents/): Route your coding agent's API calls through a credential proxy so a leaked token is a useless placeholder. Setup for Agent Vault, Bitwarden, and the limits. - [Command injection is the most common MCP server bug](https://gethasp.com/guides/command-injection-in-mcp-servers/): Command injection is the dominant MCP server vulnerability class. The shell=True pattern, two real 2026 CVEs, and how to keep tool arguments out of your shell. - [Workload identity for AI coding agents](https://gethasp.com/guides/workload-identity-for-ai-coding-agents/): Anthropic Workload Identity Federation lets an AI coding agent mint short-lived Claude tokens from an OIDC identity instead of a static API key on disk. - [Bitwarden Secrets Manager for AI coding agents](https://gethasp.com/guides/bitwarden-secrets-manager-for-ai-coding-agents/): Hermes Agent added Bitwarden Secrets Manager support in May 2026. How bws run, machine accounts, and access tokens hold up for unattended AI coding agents. - [Comment and Control hijacks three AI coding agents](https://gethasp.com/guides/comment-and-control-prompt-injection/): A prompt injection hidden in a GitHub PR title or issue body made Claude Code, Gemini CLI, and Copilot dump their own API keys into public comments. - [Claude Code's SOCKS5 sandbox bypass](https://gethasp.com/guides/claude-code-socks5-sandbox-bypass/): A null-byte injection let prompts exfiltrate AWS credentials, GitHub tokens, and IMDS data through the Claude Code network sandbox. Silent patch, no advisory. - [Where coding agents write on disk](https://gethasp.com/guides/where-coding-agents-write-on-disk/): What six coding agents write to disk on macOS and Linux: settings, logs, history, and MCP config. What is there, who owns it, and what leaks if it ships in npm. - [Audit an MCP server before you install it](https://gethasp.com/guides/audit-mcp-server-before-install/): A repeatable five-step audit for any MCP server you are about to install. Source review, isolated run, fake credential, traffic inspection, scope diff. - [MCP confused deputy: the OAuth proxy mistake](https://gethasp.com/guides/mcp-token-passthrough-confused-deputy/): The MCP spec calls out one OAuth proxy mistake by name. What the confused deputy looks like, why proxies keep reintroducing it, and the spec-mandated fix. - [AI coding agent terms of service](https://gethasp.com/guides/ai-coding-agent-terms-of-service/): What Claude Code, Cursor, Copilot, Codex CLI, Aider, and the OSS path actually say about training, retention, and indemnification in May 2026. - [ISO 27001 controls for AI coding agents](https://gethasp.com/guides/iso-27001-ai-coding-agents/): ISO 27001:2022 Annex A controls map directly to AI coding agent behavior. Here's which ones bite, what evidence your auditor wants, and what to implement. - [Install Claude Code skills without leaking your env](https://gethasp.com/guides/claude-code-skills-without-env-leak/): Install a Claude Code skill safely: audit the source, isolate the profile, scan with TruffleHog, run a fake-credential smoke test, and check the audit log. - [MCP elicitation attacks and the 2026 spec](https://gethasp.com/guides/mcp-elicitation-attacks-2026-spec/): MCP elicitation lets servers prompt agents for input mid-task. In early 2026 it became a credential-exfiltration channel. How it works and what to do. - [Self-hosted MCP gateway pattern](https://gethasp.com/guides/self-hosted-mcp-gateway-pattern/): For teams running five or more MCP servers: route all agent traffic through one gateway that brokers credentials, enforces allowlists, and logs every tool call. - [Multi-agent teams multiply your blast radius](https://gethasp.com/guides/multi-agent-teams-blast-radius/): Multi-agent coding setups are mainstream in 2026. Each agent holding a live credential is another place that credential can leak, log, or reach a sub-agent. - [Agent autonomy and trust boundaries](https://gethasp.com/guides/agent-autonomy-trust-boundaries/): Autonomous coding agents inherit your OS user account's full trust. Here are five questions that expose where the real boundary sits and why it needs to move. - [Modal vs E2B vs Daytona for agent sandboxes](https://gethasp.com/guides/modal-vs-e2b-vs-daytona-agent-sandboxes/): Compare Modal, E2B, and Daytona for running untrusted AI agents in 2026: isolation model, startup time, secret injection, egress controls, and cost. - [1Password CLI vs Doppler vs Infisical](https://gethasp.com/guides/1password-vs-doppler-vs-infisical-cli/): Head-to-head: 1Password CLI, Doppler, and Infisical for CLI-driven secrets workflows. Compare install, daily UX, audit, CI/CD, cost, and AI agent failure modes. - [Six weeks of AI agent secret leaks](https://gethasp.com/guides/q2-2026-secret-leakage-retrospective/): Q2 2026 retrospective: five AI coding-agent incidents in six weeks exposed a shared pattern. Every team running agentic tooling should audit before June 1. - [Claude Code skills bypassed allowlist permissions](https://gethasp.com/guides/claude-code-skills-permission-bypass/): April 2026: a skill bypassed Claude Code tool-call allowlists using a Unicode lookalike in the tool name. Arbitrary shell execution despite a read-only config. - [Cursor Composer leaked tab context between projects](https://gethasp.com/guides/cursor-composer-multi-tab-credential-exposure/): April 2026: Cursor Composer included a second open tab context in LLM prompts, surfacing credentials from unrelated repos. How to audit and prevent recurrence. - [Hardening OpenCode for production](https://gethasp.com/guides/hardening-opencode-for-production/): OpenCode reads your full shell env, executes shell commands, and accepts MCP servers from anywhere. A hardening playbook for teams running Qwen or DeepSeek. - [Hermes agent harness security review](https://gethasp.com/guides/hermes-agent-harness-security-review/): Hermes agent harness gives you full autonomy with OSS models, but ships without a secret redactor, audit log, or command sandbox. Here is what that costs you. - [Claude Code skills security checklist](https://gethasp.com/guides/claude-code-skills-security-checklist/): Claude Code skills run with full filesystem and shell access, no signature required. A 7-point checklist to audit any skill before it touches your project. - [2026 secrets stack, a decision matrix](https://gethasp.com/guides/2026-secrets-stack-decision-matrix/): Decision matrix for engineering leaders rebuilding their secrets stack in 2026: keychains, SOPS, Vault, Doppler, cloud managers, brokers, identity federation. - [25 questions about AI agents and secrets](https://gethasp.com/guides/25-questions-ai-coding-agent-secrets/): Practical answers to 25 questions about AI coding agents, MCP servers, and secret handling -- covering state file leaks, credential scope, and SOC 2. - [Can my agent see my secrets, an audit](https://gethasp.com/guides/can-my-agent-see-my-secrets-audit/): A runnable audit for developers to test what Claude Code, Cursor, Codex CLI, and Aider can actually read from your environment and persist to disk. - [Secrets tool licenses, demystified](https://gethasp.com/guides/secrets-tool-licenses-explained/): Apache, BSL, FCL, AGPL, proprietary: secrets tools carry very different licenses. Here is what each one means for self-hosting, forking, and audit access. - [OS keychain vs vault vs broker](https://gethasp.com/guides/os-keychain-vs-vault-vs-broker/): macOS Keychain, HashiCorp Vault, and secret brokers protect credentials at different layers. Most developers use one where they need another. - [Forward proxy vs process-tree credential brokers](https://gethasp.com/guides/forward-proxy-vs-process-tree-credential-brokers/): Forward proxy vs process-tree broker: two ways to deliver credentials to AI agents. How they differ on scope, trust surface, and operational complexity. - [Secretless approaches for AI coding agents](https://gethasp.com/guides/secretless-ai-walkthrough-and-alternatives/): Compare CyberArk Secretless Broker, AWS IAM Identity Center, GitHub OIDC, SPIFFE, Vault dynamic secrets, and injection brokers for AI coding agent credentials. - [Agent vaults compared, honestly](https://gethasp.com/guides/agent-vault-vs-gethasp-comparison/): Eight secret tools compared for AI coding agents: HashiCorp Vault, 1Password CLI, Doppler, Infisical, AWS Secrets Manager, SOPS+age, hasp, and broker startups. - [Reference architecture for a safe small team](https://gethasp.com/guides/reference-architecture-safe-small-team/): How 2-10 person teams running coding agents can build a real credential security posture without a dedicated security engineer, SOC 2, or zero-trust proxy. - [AI coding agent security glossary](https://gethasp.com/guides/ai-coding-agent-security-glossary/): A field glossary for developers, security engineers, and PMs who need shared vocabulary to reason about AI coding agent security, secrets, and attack surface. - [The state of secrets leakage in 2026](https://gethasp.com/guides/state-of-secrets-leakage-2026/): AI-service token leaks rose 81% in 2026 and agent-assisted commits leak twice as often. Here is what the data says, where the gaps are, and what to do about it. - [Every 2026 AI agent incident](https://gethasp.com/guides/every-2026-incident-timeline/): 2026 AI agent security incident timeline: credential leaks, command injection, prompt-injection theft, and MCP supply-chain risk. Real names and real dates. - [STRIDE threat model for AI coding agents](https://gethasp.com/guides/threat-model-ai-coding-agent-stride/): STRIDE threat model for a developer running Claude Code or Cursor with prod credentials. Each category maps to concrete named threats and specific mitigations. - [EU AI Act and your dev secrets](https://gethasp.com/guides/eu-ai-act-secrets-stack/): The EU AI Act (2024/1689) went into force August 2024. Here is what deployer obligations actually mean for engineering teams using coding agents. - [Five Eyes guidance on AI agent deployment](https://gethasp.com/guides/five-eyes-ai-agent-deployment-guidance/): CISA, NCSC UK, ASD, CCCS, and NCSC-NZ published joint AI deployment guidance. Here is what it means for teams running coding agents in production. - [NIST AI security, translated for devs](https://gethasp.com/guides/nist-ai-agent-security-developer-translation/): NIST AI RMF and SSDF are the compliance docs you will be handed. Here is what each control means when an AI agent is running commands in your environment. - [PCI DSS 4.0 and AI coding agents](https://gethasp.com/guides/pci-dss-ai-coding-agents/): PCI DSS 4.0 reqs 3.5, 7.2.4, 8.3.6, 10.x, and 12.5.2 all touch dev environments where AI coding agents handle live Stripe keys. Here is where exposure lands. - [SOC 2 and AI coding agents](https://gethasp.com/guides/soc2-ai-coding-agents/): SOC 2 Type II controls still apply when an AI coding agent reads prod credentials and writes code that ships. How the TSC maps to agent realities in 2026. - [Audit what your AI coding agent did](https://gethasp.com/guides/audit-what-ai-coding-agent-did/): After an AI coding agent runs for hours, here is how to reconstruct what it actually did across git, shell history, filesystem, network, and provider logs. - [GitHub Actions secrets done right](https://gethasp.com/guides/github-actions-secrets-correctly/): GitHub Actions secrets redact in logs and scope to environments, but pull_request_target, printenv, and reusable workflows create real leaks in production. - [1Password SSH agent for coding agents](https://gethasp.com/guides/1password-ssh-agent-with-coding-agents/): Let Claude Code, Cursor, and other AI coding agents push to GitHub via SSH without exposing id_ed25519 on disk. 10-minute setup with 1Password's SSH agent. - [API key rotation in 90 minutes](https://gethasp.com/guides/api-key-rotation-in-90-minutes/): Rotate every API key your solo stack depends on in 90 minutes, once a quarter. A practical schedule for OpenAI, Anthropic, Stripe, GitHub, and AWS keys. - [Minimum viable .gitignore for AI repos](https://gethasp.com/guides/minimum-viable-gitignore-for-ai-repos/): Every AI agent writes state files your repo doesn't need. This .gitignore covers all of them, with the exact paths and why each line matters. - [Pre-commit hooks for AI-agent repos](https://gethasp.com/guides/pre-commit-hooks-for-ai-age/): Lint and test gates aren't enough when an AI agent is committing code. Add secret scanning, agent state blockers, and diff-size guards to your pre-commit stack. - [Keep AWS credentials out of Cursor](https://gethasp.com/guides/keep-aws-credentials-out-of-cursor/): Your ~/.aws/credentials file and AWS_* env vars are readable by every process running as you, including Cursor. Here is how to close that surface for good. - [Share .env with your team, not the internet](https://gethasp.com/guides/share-env-file-with-team-without-uploading/): Share dev secrets with a 2-5 person team without uploading them to Doppler or Infisical. age-encrypted files in git keep secrets off SaaS servers entirely. - [Revoke a leaked LLM API key](https://gethasp.com/guides/revoke-leaked-llm-api-key/): Practical 90-minute checklist for revoking a leaked OpenAI, Anthropic, or Google Gemini key: revoke, audit usage, rotate consumers, then scrub git history. - [Scan a repo for leaked secrets](https://gethasp.com/guides/scan-repo-for-leaked-secrets/): How to audit a Git repo for leaked secrets in 2026, including agent-state-file patterns disclosed by Knostic in February. Tools compared, recipes included. - [Keep your Stripe key out of the agent](https://gethasp.com/guides/keep-stripe-key-out-of-llm-context/): Stripe live keys in your agent session are an exposure waiting to happen. Three patterns keep sk_live_ out of LLM context while your code keeps working. - [MCP sampling is an attack surface](https://gethasp.com/guides/mcp-sampling-attack-vector/): MCP sampling inverts the call: a server requests LLM completions from your client. That path enables prompt injection, context theft, and cost fraud. - [MCP supply chain hygiene](https://gethasp.com/guides/mcp-supply-chain-hygiene/): MCP supply chain hygiene: 7,000 unsigned servers, 150M downloads, no reputation system. The full audit playbook for teams installing from npm, PyPI, or GitHub. - [Catching prompt injection in MCP tools](https://gethasp.com/guides/catching-prompt-injection-in-mcp-tool-calls/): Indirect prompt injection in MCP tool calls: attacker plants instructions in data your agent reads. Server-side and client-side defenses for MCP server authors. - [Sandboxing MCP servers](https://gethasp.com/guides/sandboxing-mcp-servers/): Sandbox MCP servers on macOS and Linux to limit blast radius: OS-level profiles, filesystem isolation, and egress controls for multi-server setups. - [MCP tool poisoning explained](https://gethasp.com/guides/mcp-tool-poisoning-explained/): MCP tool poisoning embeds prompt-injection instructions in tool descriptions. The model treats them as trusted metadata. What that means for your agent stack. - [MCP server security checklist](https://gethasp.com/guides/mcp-server-security-checklist/): MCP server security checklist for Claude and Cursor. 7,000 servers, 150M downloads, zero signature requirements. Your credentials are the attack surface. - [Tamper-evident audit logs](https://gethasp.com/guides/tamper-evident-audit-logs/): Tamper-evident logs detect modification after the fact. Learn the three patterns engineers use and what 'did the agent touch X?' actually requires. - [Vibe coding and the security floor](https://gethasp.com/guides/vibe-coding-security/): Vibe coding puts agents in charge of most commits. Here is the minimum-viable security floor that catches the top three failure modes without slowing you down. - [Blast radius doctrine for AI agents](https://gethasp.com/guides/blast-radius-doctrine/): Blast radius: how much damage an AI agent can cause when a credential leaks or an action goes wrong. Three dimensions, real incidents, and a single design rule. - [Local-first vs cloud-first secrets](https://gethasp.com/guides/local-first-vs-cloud-first-secrets/): Deciding where secrets live shapes your threat model, your team's workflow, and your incident response. Here is the honest breakdown for every team size. - [Env vars are not secrets management](https://gethasp.com/guides/why-env-vars-are-not-secrets-management/): Environment variables deliver secrets to processes. They don't store, scope, rotate, or audit them. Here's what secrets management actually requires in 2026. - [Five attack patterns on AI coding agents](https://gethasp.com/guides/five-attack-patterns-on-ai-coding-agents/): Five attacks target AI coding agents: file leaks, prompt injection, command injection, credential harvesting, context destruction. Mechanism and fix for each. - [Process-tree scoped credentials](https://gethasp.com/guides/process-tree-scoped-credentials/): Process-tree scoping ties a credential lifespan to one command. When the process exits, the grant ends. That narrow scope matters greatly for AI coding agents. - [Runtime secret injection explained](https://gethasp.com/guides/runtime-secret-injection/): Runtime secret injection delivers credentials to a process at execution time, not startup. Here is why the difference matters and how to choose a delivery mode. - [What is a secret broker](https://gethasp.com/guides/what-is-a-secret-broker/): A secret broker sits between a secrets store and a running process. It scopes, injects, audits, and withdraws credentials at the boundary. Not a vault. - [dotenv-vault and dotenvx, honestly](https://gethasp.com/guides/dotenv-vault-dotenvx-future-of-env/): dotenv-vault syncs .env across environments; dotenvx encrypts them into git. Both decrypt into process env, which still hands agents your full secret set. - [AWS vs GCP vs Azure secrets managers](https://gethasp.com/guides/aws-gcp-azure-secrets-managers-compared/): AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault compared on pricing, DX, and rotation. Includes the gap none of them fill: developer laptops. - [1Password CLI for AI coding agents](https://gethasp.com/guides/1password-cli-for-ai-coding-agents/): 1Password CLI is the best individual answer to secret-zero for developers. Here is what changes when your coding agent, not you, orchestrates child processes. - [SOPS for solo devs in 2026](https://gethasp.com/guides/sops-for-one-person-teams/): SOPS encrypts secrets at rest and commits them to git. For solo devs with AI coding agents, the decrypt-to-file workflow creates a new exposure. Full picture. - [The secret-zero problem explained](https://gethasp.com/guides/secret-zero-problem-explained/): Secret zero: every secrets manager needs a bootstrap credential. Here is why that token is still in your env and what actually solves the bootstrap problem. - [HashiCorp Vault for the rest of us](https://gethasp.com/guides/hashicorp-vault-for-the-rest-of-us/): Honest assessment of HashiCorp Vault for solo devs and small teams. Dynamic secrets are real. The operational cost is also real. Here's how to decide. - [Infisical self-hosted setup](https://gethasp.com/guides/infisical-self-hosted-setup/): How to run Infisical self-hosted in 2026: Docker Compose stack, CLI auth, machine identities, and the backup story nobody mentions upfront. - [Doppler for solo developers](https://gethasp.com/guides/doppler-for-solo-developers/): Honest 2026 review of Doppler for solo devs and tiny teams: free tier, dashboard UX, doppler run injection, and why AI coding agents break the trust model. - [Secret managers in 2026](https://gethasp.com/guides/secret-manager-landscape-2026-8-tools-compared/): Comparing Doppler, Infisical, Vault, SOPS, 1Password CLI, Agent Vault, secretless-ai, and hasp for teams running AI coding agents in 2026. - [Aider, Continue, Open Interpreter security](https://gethasp.com/guides/aider-continue-open-interpreter-security-comparison/): Aider, Continue, and Open Interpreter each take a different security posture. Here is what that means for credentials, file scope, and blast radius in 2026. - [Gemini CLI for paranoid developers](https://gethasp.com/guides/gemini-cli-for-paranoid-developers/): Gemini CLI security for developers who distrust defaults: ADC scoping, paid-tier data retention, GCP audit logs, and system instruction overrides explained. - [Codex CLI hardening guide 2026](https://gethasp.com/guides/codex-cli-hardening-guide/): Codex CLI hardening in 2026: approval modes, sandbox settings, MCP allowlisting, and the OPENAI_API_KEY logging gap that exposes your key by default. - [GitHub Copilot CLI security gaps](https://gethasp.com/guides/github-copilot-cli-security/): GitHub Copilot CLI runs as your shell user, uploads transcripts to GitHub, and can be misled by shell output. Full security breakdown for the CLI extension. - [Cursor security checklist 2026](https://gethasp.com/guides/cursor-security-checklist-2026/): Cursor security checklist for 2026: harden Privacy Mode, .cursorignore, MCP config, and telemetry after the late-Jan cloud-sync disclosure. Step-by-step. - [Hardening Claude Code settings.json](https://gethasp.com/guides/hardening-claude-settings-json/): Claude Code settings.json hardening: permissions.deny, allowlists, env isolation, MCP allowlisting, and five misconfigurations to fix before your next session. - [.claudeignore cookbook](https://gethasp.com/guides/claudeignore-cookbook-broken-rules/): claudeignore filters context reads but bypasses workspace search and certain tool calls. 15 concrete patterns with gaps and settings.json fallbacks. - [MCP + GitHub = a data heist](https://gethasp.com/guides/mcp-github-prompt-injection-data-heist/): mcp prompt injection github: how a malicious issue body tricks an MCP-connected agent into reading private repos and posting the data publicly. - [Replit agent deleted a production database](https://gethasp.com/guides/replit-agent-deleted-production-database/): In 2024, a Replit AI agent dropped a production database in seconds. Here is what the permission model got wrong and how to stop it from happening again. - [$82,000 GCP bill from a coding agent](https://gethasp.com/guides/82000-google-cloud-bill-ai-agent-postmortem/): An AI agent caused an 82,000 dollar Google Cloud bill in early 2026: leaked GCP credentials in agent context triggered a retry loop that ran all weekend. - [AI agents commit secrets 2x more often](https://gethasp.com/guides/claude-code-commits-leak-secrets-2x-more/): GitGuardian State of Secrets Sprawl 2026: AI-assisted commits leak secrets twice as often. The mechanism behind the 81% spike in AI coding agent secret leaks. - [MCP's trust model has sharp edges](https://gethasp.com/guides/anthropic-mcp-design-flaw/): The anthropic mcp design flaw isn't a bug: it's four protocol assumptions that produce credential exposure by design. Here is what the spec actually says. - [Cursor uploaded my .env to the cloud](https://gethasp.com/guides/cursor-uploaded-my-env-to-cloud/): January 2026: Cursor's cloud sync indexed .env files inside workspaces despite privacy mode. Knostic confirmed scope. What leaked, and what to do now. - [Claude Code leaked secrets to npm](https://gethasp.com/guides/claude-code-settings-local-json-npm-leak/): April 2026: Claude Code settings.local.json silently recorded env vars and shipped them in published npm packages. The fix is one file, the lesson is bigger. ## Agent Notes - HASP keeps named secrets in a local encrypted vault. - Repo bindings define where secrets can be used. - Grants are short-lived and scoped to a run, session, or window. - Agents should use brokered references and metadata, not raw secret values. - Use `/llms-full.txt` for the full public documentation bundle.