---
title: "Keep secrets out of code · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep secrets out of code

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Never write a password, key or token into code, settings files in the repo, or its history.
- How: Read secrets from environment variables or a secret store at start-up. Add a secret scanner, such as gitleaks, to the pre-commit hook and the build. A secret that ever reached the repo is leaked, so replace it, even after you delete the commit.
- Check: The agent runs a secret scanner over the whole history, not only the latest commit. It finds no live key.

Example:

```sh
# gitleaks 8.19 or later scans every commit on every branch
gitleaks git --redact --log-opts="--all" .
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code`.

- Next: [Keep secrets out of the browser](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-browser)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)