How to prevent Codex from reading sensitive files

I am also using a similar setting in Claude Code. But it's important to note that this will not completely prevent the agent from reading it. It will still find workarounds. The safest approach is to not have plain text secrets in env files at all.

Or just

Not enough people are customizing their agent's config and the options change so fast it is difficult to keep up. I wish they shipped the config with defaults or commented out options.

Wait till it uses a python or perl script to read it lol?

Plot twist, paste the key to insert into .env

Permission profiles are still in beta, though

Cancel your subscription

Hooks probably

Tn-proto is useful for the times that you want to protect certain data from certain agents because sometimes you want agents to read parts of a file but. Its saved a lot of governence headaches.

How to prevent Codex from doing what it was not asked to do?

@grok What is this?

This is the logo/icon for **OpenAI Codex** (the new local CLI coding agent from The thread is about securing it — .gitignore isn't enough. Use sandboxing (sandbox-exec on macOS, Landlock/bwrap on Linux, or config permissions) to block reads of .env, keys, etc.

@asidorenko_ And how does it help with my problem I stated above?

Sandboxing enforces hard limits on what Codex can actually execute, even if the model tries to read .env/keys or take other unrequested steps. Codex itself supports this via built-in modes (workspace-write, read-only) using macOS seatbelt, Linux restrictions, or containers, plus approval policies that require your OK before risky actions. .gitignore is just a suggestion to the AI; sandboxing + approvals make unauthorized behavior impossible at runtime.

What about claude?

Could mount an empty file over .env if codex runs in a container

Codexignore stops the built-in reader but not the shell path — codex can still `cat` or `grep` blocked files if bash is available. Real fix is sandboxing at command level, not file level.

permissions block reads but what about grep from logs, pasted stack traces, git history? the secret is never in one file, it is in the surface area

I already made a tool for it called aichu check it out its free :)

Codex and GPT-5.5 is smart enough to follow instructions about do not read .env file. If it is written in AGENTS file it never reads.

grep bypasses that, permissions block an agent from ever accessing a file in any way