Unverified50% confidenceDecision RuleExact time
When reading source files, only documents are read; .env and secret files are never opened, and the characters see the brief rather than the user's code.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn the OpenCode official documentation, both the .env protection example and the company.guard example register an execute.before hook only for the read tool, and do not intercept the behavior of reading files via shell commands (such as cat).69% similarUnverifiedFull credentials should not be pasted into chat windows or hard-coded into project code; they should be stored in a keychain or written to a .env file excluded by .gitignore.66% similarUnverified对象存储等密钥信息只在本地读取，不写死在代码里，也不提交到代码仓库。64% similarUnverifiedThe .env file is usually gitignored and is not automatically carried over when a worktree is created, which may cause an agent to read wrong default values or fail to start.64% similarUnverifiedWindows默认隐藏已知文件类型的扩展名，导致用户创建.env文件时实际生成的是.env.txt62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1070806API
curl https://kongchang.com/api/v1/knowledge/claims/1070806MCP
get_claim(id=1070806)