Pragma Secrets

Pragma includes support for environment variables and external secrets so users do not need to paste sensitive values into plain text files or chat messages.

Users should treat this area as the safe place for API keys, tokens, and environment values needed by terminal commands, workflows, and AI-assisted development.

What Counts As A Secret

Secrets include:

• API keys.
• Database passwords.
• OAuth client secrets.
• Cloud tokens.
• Webhook signing secrets.
• Private service credentials.

How Users Should Use Secrets

Users should store secrets in the secrets manager or approved environment variable flow, then reference them from terminal sessions, workflows, or agent tasks.

They should avoid:

• Pasting secrets into prompts.
• Committing .env files.
• Saving production keys in screenshots.
• Sharing secrets through normal chat.

Environment Variables

Environment variables let users provide configuration to commands without hardcoding values into source code.

Example:

export CREDVAULT_API_KEY="..."
npm run deploy

In production usage, the value should be stored securely and injected when needed.

AI Agent Safety

The AI agent should not expose secrets in answers, diffs, logs, or generated files. Secret redaction and careful command approval are important for sensitive data.