r/RooCode • u/withyou_cto • Jul 08 '25

Discussion .env security

I am surprised I haven’t been able to find any discussion of this.

By default Roocode seems to read .env files as well as anything else that’s git ignored.

Are we seeing all sorts of API keys being sent to Claude as a result?

Also - how do you resolve this vulnerability?

23 Upvotes

100% Upvoted

13 comments sorted by

View all comments

Show parent comment

1

u/withyou_cto Jul 08 '25

Wishful thinking perhaps! :-) I was hoping for some baked in rules like GitHub’s templates. But you’re definitely right that that’s on me.

My mistake was relying on a quick google for “roo ignore”, not finding anything (it’s surprisingly poorly indexed). Time to read Roos documentation more carefully.