Giving coding agents shell access feels insane. How are people handling secrets?

I keep coming back to this problem, If an agent has shell access, it can read things a normal developer can read. .env, config files, tokens, local credentials, package scripts, logs, whatever. Even if it doesn’t “leak” them maliciously, it can paste them into a transcript, modify a script that prints them, run env, inspect process state, or accidentally create a trail nobody intended. The old dev environment assumes a human is at the keyboard. That assumption feels broken now. So what’s the sane pattern? local vaults? short-lived credentials? command approval? immutable worktrees? broker/proxy model where the agent never sees the secret? separate sandbox per task? no secrets locally, ever? I don’t want hand-wavy security theater. I want to know what people are actually doing before letting agents touch real repos.