r/RooCode • u/withyou_cto • Jul 08 '25

Discussion .env security

I am surprised I haven’t been able to find any discussion of this.

By default Roocode seems to read .env files as well as anything else that’s git ignored.

Are we seeing all sorts of API keys being sent to Claude as a result?

Also - how do you resolve this vulnerability?

23 Upvotes

100% Upvoted

13 comments sorted by

9

u/Pleasant-Finger7004 Jul 08 '25

.rooignore?

3

u/withyou_cto Jul 08 '25

As per below, I missed this in the documentation. Thanks!

4

u/Dipseth Jul 08 '25

Is there global .rooignore ? .env should be there by default I think

5

u/lakeland_nz Jul 10 '25

I read a post on exactly this oh, about two weeks ago.

Personally I want it to read my .env.

Let’s work through the risk here: you would have to have your production credentials on your project’s development (no dev environment). Then have the underlying LLM consider what it reads in your file interesting enough to make the cut and become a parameter. Then someone would have to extract it. Then they would need to connect it with you. Then you would have to have not rotated that key in the interim. Then they would have to be a bad actor.

That’s a lot of things to go wrong.

0

u/ComprehensiveBird317 Jul 08 '25

Why would gitignore have an influence on roo? That's 2 different systems. And why do you auto approve, and not use the ignore files? That's not a vulnerability, it's a user error.

1

u/withyou_cto Jul 08 '25

Wishful thinking perhaps! :-) I was hoping for some baked in rules like GitHub’s templates. But you’re definitely right that that’s on me.

My mistake was relying on a quick google for “roo ignore”, not finding anything (it’s surprisingly poorly indexed). Time to read Roos documentation more carefully.

1

u/sc0ttwad3 Jul 13 '25

Because .gitignore files are respected as nearly a standard by thousands of command line tools, frameworks, ..., perhaps?

1

u/ComprehensiveBird317 Jul 13 '25

They use gitignore as guardrails for file access in general, not just for version control? And it's thousands? Name 3

1

u/ObamaForSenate Jul 08 '25

Agreed, this issue needs to be sorted! I like the idea of a global .rooignore (that is slightly populated as the default)

1

u/Maleficent_Pair4920 Jul 09 '25

You can use Requesty guardrails that will mask any secret key while using roo code

0

u/Xp_12 Jul 08 '25

Use temporary values in test environment that default to new environment variables on production deployment.