Where credentials sit on a developer machine that an agent process can read

What it is

A coding agent or tool server usually runs under the developer's own account. Any code it runs — including an install script from a dependency — can read the same files. Common locations:

• Environment variables of the agent process and its children. On Linux, /proc/<pid>/environ exposes the initial environment of a process to its owner; the man page notes it reflects the environment at exec time.
• Cloud CLIs: the AWS CLI keeps credentials in ~/.aws/credentials and settings in ~/.aws/config; other clouds use similar directories under the home directory.
• Container registries: docker login stores credentials in ~/.docker/config.json unless a credential store or helper is configured, in which case the file references the helper.
• Package registries: ~/.npmrc, ~/.pypirc, ~/.cargo/credentials, Maven settings.xml.
• Git and code hosts: credential helper stores, ~/.git-credentials when the plain store helper is used, CLI tokens for code hosts.
• SSH: private keys in ~/.ssh, and an agent socket that signs for whoever can reach it.
• Kubernetes: ~/.kube/config with cluster certificates or tokens.
• History and notes: shell history containing tokens pasted into commands, .env files in project directories, .netrc.

Why it matters

Isolation promises made at the prompt level ("the agent will not read secrets") do not bind code the agent executes. Inventorying the locations turns a vague risk into a list of concrete exposures.

How to apply

• Run agents under a separate user or in a container with a home directory that contains only what the task needs.
• Pass short-lived, narrowly scoped tokens for the task instead of the developer's long-lived ones.
• Prefer OS keychains or credential helpers over plain files; they do not stop a process running as the user, but they remove the easy path.
• Scrub the environment passed to child processes to what they need.
• After any suspected compromise of an agent session, rotate every credential readable from its account, not only the ones it was known to use.

Pitfalls

• Unsetting a variable after start-up: /proc/<pid>/environ still shows the initial value.
• Forgetting sockets (SSH agent, Docker daemon), which grant power without any file to read.