chore(repo): Add AI agent security protections for sensitive files #7580
Conversation
🦋 Changeset detectedLatest commit: 361b8f5 The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughAdds several configuration and ignore files: a new changeset file 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.claude/settings.json:
- Around line 18-23: Update the Bash rule pattern to cover nested files by
changing the rule that currently uses Bash(cat secrets/*) to use Bash(cat
secrets/**) so it matches subdirectories as Read(secrets/**) does; also ensure
the Read(secrets/**) deny rule remains the primary protection and confirm
disableBypassPermissionsMode is enabled so Bash command expansion cannot bypass
Read() restrictions (adding other Bash verbs like less/head/tail is optional but
not a substitute for the Read() deny rules).
🧹 Nitpick comments (1)
.cursorignore (1)
1-20: LGTM!Patterns are consistent with the other ignore configurations. The coverage is comprehensive for protecting sensitive files from AI indexing.
Optional: Consider adding a note similar to
.geminiignoreabout the bypass limitation mentioned in the PR description ("shell commands can bypass"), so developers are aware of this constraint without needing to reference PR history.📝 Optional: Add bypass warning
# AI Agent Security - Sensitive Files # These files should never be read by AI tools to prevent # accidental exposure of secrets to AI service providers. +# +# NOTE: Cursor may still read these files via shell commands. # Environment files
📜 Review details
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (5)
.changeset/quick-breads-follow.md.claude/settings.json.cursorignore.geminiignore.gitignore
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (25)
- GitHub Check: Integration Tests (nextjs, chrome, 16, RQ)
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (machine, chrome)
- GitHub Check: Integration Tests (machine, chrome, RQ)
- GitHub Check: Integration Tests (custom, chrome)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (billing, chrome, RQ)
- GitHub Check: Integration Tests (nextjs, chrome, 16)
- GitHub Check: Integration Tests (quickstart, chrome, 16)
- GitHub Check: Integration Tests (quickstart, chrome, 15)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (sessions:staging, chrome)
- GitHub Check: Integration Tests (handshake:staging, chrome)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (handshake, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: semgrep-cloud-platform/scan
🔇 Additional comments (4)
.gitignore (1)
107-109: LGTM!The addition properly excludes user-specific Claude Code settings from version control, allowing developers to customize their local permissions without affecting the shared configuration. Good placement alongside the existing
CLAUDE.local.mdentry..changeset/quick-breads-follow.md (1)
1-2: LGTM!Empty changeset is appropriate here since this PR only adds tooling configuration files and doesn't affect any publishable packages.
.claude/settings.json (1)
1-17: LGTM on the Read/Edit deny rules.Comprehensive coverage of sensitive file patterns including environment files, secrets directory, credentials, and cryptographic key material. The structure follows the expected Claude Code settings format.
.geminiignore (1)
1-23: LGTM!Good documentation of the limitation that Gemini CLI can bypass these rules if explicitly instructed. The patterns are consistent with the other ignore files in this PR (.cursorignore and .claude/settings.json).
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
Add configuration files to prevent AI tools from reading secrets: - .claude/settings.json: Hard deny rules for Claude Code - .cursorignore: Ignore patterns for Cursor - .geminiignore: Ignore patterns for Gemini CLI Protected patterns include .env files, secrets/, credentials.json, private keys (.pem, .key), and integration/.keys.json
jacekradko
force-pushed
the
jacek/ai-agent-security-protections
branch
from
7cce42f to
128b912
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.cursorignore (1)
1-4: Add bypass warning for consistency and user awareness.The
.geminiignorefile includes a warning that "Gemini CLI may still read these files if explicitly instructed." According to the PR objectives, Cursor can also bypass these protections via shell commands. Consider adding a similar warning to inform users of this limitation.📝 Proposed documentation addition
# AI Agent Security - Sensitive Files # These files should never be read by AI tools to prevent # accidental exposure of secrets to AI service providers. # +# NOTE: Shell commands executed through Cursor can bypass these protections. +
📜 Review details
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (5)
.changeset/quick-breads-follow.md.claude/settings.json.cursorignore.geminiignore.gitignore
🚧 Files skipped from review as they are similar to previous changes (2)
- .gitignore
- .claude/settings.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (27)
- GitHub Check: Integration Tests (machine, chrome, RQ)
- GitHub Check: Integration Tests (nextjs, chrome, 16)
- GitHub Check: Integration Tests (tanstack-react-start, chrome)
- GitHub Check: Integration Tests (custom, chrome)
- GitHub Check: Integration Tests (quickstart, chrome, 15)
- GitHub Check: Integration Tests (react-router, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 16, RQ)
- GitHub Check: Integration Tests (quickstart, chrome, 16)
- GitHub Check: Integration Tests (vue, chrome)
- GitHub Check: Integration Tests (nextjs, chrome, 15)
- GitHub Check: Integration Tests (billing, chrome, RQ)
- GitHub Check: Integration Tests (handshake, chrome)
- GitHub Check: Integration Tests (machine, chrome)
- GitHub Check: Integration Tests (nuxt, chrome)
- GitHub Check: Integration Tests (sessions:staging, chrome)
- GitHub Check: Integration Tests (billing, chrome)
- GitHub Check: Integration Tests (generic, chrome)
- GitHub Check: Integration Tests (localhost, chrome)
- GitHub Check: Integration Tests (astro, chrome)
- GitHub Check: Integration Tests (ap-flows, chrome)
- GitHub Check: Integration Tests (handshake:staging, chrome)
- GitHub Check: Integration Tests (sessions, chrome)
- GitHub Check: Integration Tests (express, chrome)
- GitHub Check: Formatting | Dedupe | Changeset
- GitHub Check: Build Packages
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: semgrep-cloud-platform/scan
🔇 Additional comments (4)
.changeset/quick-breads-follow.md (1)
1-2: Verify if an empty changeset is intentional.This changeset file contains only YAML delimiters with no package changes or description. For a chore PR that adds configuration files without affecting published packages, an empty changeset might be appropriate. However, please confirm this is intentional rather than incomplete.
.geminiignore (2)
6-6: GitHub issue reference is valid and publicly accessible.The issue google-gemini/gemini-cli#13385 exists and returns HTTP 200, confirming it is properly referenced and accessible.
9-10: The .env patterns are already protecting subdirectories recursively.According to gitignore semantics (which
.geminiignoreuses), patterns without a leading/match at any directory level. The.envand.env.*patterns on lines 9-10 will match files anywhere in the repository, not just the root. The**/prefix on other patterns (like**/credentials.json) is redundant for this use case—both syntaxes achieve the same effect. Additionally, a search of the repository found no actual.envfiles in subdirectories; only example and sample files exist (.env.example,.env.sample, etc.).Likely an incorrect or invalid review comment.
.cursorignore (1)
6-7: The review comment's premise is factually incorrect. According to gitignore pattern specifications (which Cursor's.cursorignorefollows exactly), the pattern.envwithout a leading slash matches.envfiles at any depth in the repository—it is recursive by default. The patterns.envand**/.envare functionally equivalent. Therefore, the existing patterns in lines 6–7 already protect.envfiles in subdirectories, and the proposed fix is unnecessary. No security gap exists for environment file patterns in this file.Likely an incorrect or invalid review comment.
Summary
Adds configuration files to prevent AI coding tools from reading sensitive files, mitigating the risk of secrets being exposed to AI service providers.
Files created:
.claude/settings.json- Hard deny rules for Claude Code (cannot be bypassed).cursorignore- Ignore patterns for Cursor (note: shell commands can bypass).geminiignore- Ignore patterns for Gemini CLI (note: explicit read commands can bypass)Protected patterns:
.envand.env.*(environment files)secrets/directory**/credentials.json**/*.pemand**/*.key(private keys)**/.keys.json(integration keys)Also updated:
.gitignore- Added.claude/settings.local.jsonto exclude user-specific Claude settingsTest plan
.claude/settings.jsonSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.