Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/bernierllc/agents-environment-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/bernierllc/agents-environment-config/secrets)<a href="https://agentmods.dev/rules/bernierllc/agents-environment-config/secrets"><img src="https://agentmods.dev/badge/rules/bernierllc/agents-environment-config/secrets/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/bernierllc/agents-environment-config/secrets"><img src="https://agentmods.dev/badge/rules/bernierllc/agents-environment-config/secrets.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00406 | $0.00406 |
| Opus 5.5 | $0.00162 | $0.00162 |
| Sonnet 5.5 | $0.00081 | $0.00081 |
| Haiku 4.5 | $0.00041 | $0.00041 |
Grade A, and why
secrets scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Secrets Management
Core Principles
- Never commit
.env*files to version control - Use secure secret management systems (Azure Key Vault, AWS Secrets Manager, etc.)
- All secrets via secure storage (e.g.,
kv://sites/<name>) - Rotate keys regularly (every 90 days recommended)
- CI jobs check expiry automatically
Environment Variables
Secure Storage
- Store secrets in secure vaults, not in code
- Use environment variables for configuration
- Reference secrets by path (e.g.,
kv://sites/<name>) - Never hardcode secrets in application code
Key Rotation
- Rotate keys every 90 days
- Use CI jobs to check key expiry
- Automate key rotation when possible
- Document key rotation procedures
Secret Management Best Practices
Storage
- Use Azure Key Vault or equivalent
- Reference secrets by path, not by value
- Use different secrets for different environments
- Never store secrets in database or logs
Access
- Limit access to secrets (principle of least privilege)
- Use service principals for automated access
- Audit secret access
- Rotate secrets when compromised
Development
- Use
.env.examplefiles (without real values) - Document required environment variables
- Use local secrets for development only
- Never commit actual secrets
Security Checklist
- No secrets in version control
- Secrets stored in secure vault
- Environment variables documented
- Key rotation schedule established
- CI checks for secret expiry
- Access controls configured
- Audit logging enabled
References
- Security: See
general/security.mdc - Authentication: See
topics/security/authentication.mdc
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 64 lines · 406 tokens per session scan A b94d95422132
secrets is a cursor rule published in the GitHub repository bernierllc/agents-environment-config (11 stars, last pushed today), licensed MIT. It adds 406 tokens to every session, about $0.0016 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
varlock
Rules for working with varlock env-spec files, providing syntax highlighting, autocompletion, and validation for environment variable specifications.
cursor-rules-location
description: Cursor Rules Location globs: .mdc.
env-graph-tests
Cursor rule "env-graph-tests" from dmno-dev/varlock, covering rule: general test structure for env-graph, description, rationale, requirements and example.
style-guide
name: styleguidegeneral.
github-workflow
GitHub invariants — standard flow on listed use cases; no issue spam; tick linked checklists before merge.
skill-selection
Pick the fewest skills for this task. Core lifecycle for non-trivial work; extras only on a matching signal. Catalog is using-agent-skills, not this rule.