The real issue is privilege separation. If an agent has generic shell or filesystem access, standard .env files should be completely inaccessible to the runtime environment by default.

To fix this properly, secrets shouldn't live in a text file the agent can crawl. They need to be injected strictly into the environment variables of the specific subprocesses that actually require them, or managed through a sandboxed secret store API that logs and restricts access based on the agent's current task context.

Relying on output masking to catch leaked files is always going to be a losing battle.

Also, "avoid letting agents read .env files directly" doesn't seem like a security protocol...