What I learned by putting GitHub Copilot behind a MitM proxy

Re:What I learned by putting GitHub Copilot behind a MitM proxy by jiehong on Tuesday August 11, 2026 @04:52PM (#49264313)

How do you actually cleanly solve that .env issue?

Anything cross platform and coding agent agnostic?

I suppose that .env file should be removed, but then things aren’t easy: no native multiplatform secret manager, or the std lib of the language doesn’t offer an API over the native secret store, etc.

Or a "secret injection proxy" for some cases could work I guess.

[ Parent | on HN ]

Re:What I learned by putting GitHub Copilot behind a MitM proxy by ElectricalUnion on Tuesday August 11, 2026 @06:23PM (#49265309)

Infisical, or Bitwarden Secret Manager? Those two look like perfectly reasonable if the llm is just careless (but still, nothing prevents the LLM from intentionally cat'ing /proc/self/environ or from running /usr/bin/env or set or similar)

[ Parent | on HN ]

Re:What I learned by putting GitHub Copilot behind a MitM proxy by theozero on Tuesday August 11, 2026 @06:47PM (#49265535)

https://varlock.dev (free, open source) can pull secrets from many places, and has a credential broker (proxy) to inject placeholders, then replace with real secrets at the network boundary. There are a few other tools like this, but ours seems to be the most flexible so far.

[ Parent | on HN ]

Re:What I learned by putting GitHub Copilot behind a MitM proxy by mehackernewsacc on Tuesday August 11, 2026 @06:07PM (#49265155)

Do you feel that something like https://secretspec.dev/ addresses these points?

[ Parent | on HN ]

Re:What I learned by putting GitHub Copilot behind a MitM proxy by sandos on Tuesday August 11, 2026 @05:15PM (#49264592)

Data retention clauses?

I dont see how you can ever really trust an LLM anyway to follow instructions.

[ Parent | on HN ]