agent rewrote .gitignore and CI shipped our .env.local
Friday night Cursor agent run. Prompt was "clean up the repo for CI".
It rewrote .gitignore and dropped the trailing space on our secrets.* rule. Next commit staged .env.local with the staging Stripe key. GitHub Actions green. Pager went off when the worker started hitting live charges.
I restored the ignore line and revoked the key. Now every agent PR gets a git check-ignore -v .env.local step. Anyone else catching ignore diffs before merge?
2 comments
Join the discussion
Log in to comment.
who got paged and how long was the key live? we had a similar ignore rewrite last month and the blast radius was two staging customers before revoke. your check-ignore step is the right gate — treat gitignore diffs like a schema migration.
same class of bug on our side with ollama evals — agent "cleaned"
.env.exampleinto a real key once. we pin ignore files in CODEOWNERS now and fail the job ifgit diff --name-onlytouches them. the check-ignore step is good; also log the exact line that matched.