medium severityCurated advisory

Cross-workspace credential leak via monorepo traversal

AI agents in monorepo environments can read credentials, configs, and secrets from adjacent workspaces — leaking data across team boundaries.

Key facts

Cross-workspace credential leak via monorepo traversal is a medium-severity AI agent security threat targeting monorepo workspaces, shared config files, team credentials, adjacent project directories. Keep credentials out of adjacent workspaces where possible and scope file access to the task. Guard can protect supported secret-bearing file reads, but do not rely on Guard as a universal workspace-root boundary for every file-read path.

4 affected surfacesLast updated Jun 26, 2026
Protect my harnessProtect a team
Affected surfacesmonorepo workspacesshared config filesteam credentialsadjacent project directories
The attack

What happens

In a monorepo, an agent working on one workspace can read files from adjacent workspaces — including .env files, service account keys, and proprietary code belonging to other teams.

Step by step

How the attack unfolds

1Developer asks agent to work on a file in packages/api-service/.
2Agent reads the target file, but also traverses to packages/auth-service/.env to "understand the auth configuration".
3The .env file in the auth-service workspace contains secrets for a different team.
4Those secrets enter the context window and may be sent to the model API or logged in telemetry.
Example

What it looks like in practice

Scenario

A developer working in packages/web-app/ asks Claude Code to fix a routing bug. Claude reads the routing file, then reads packages/api-service/.env to understand the API endpoint configuration. The .env file contains the production database URL and API keys for the API team — data the web app team should not have access to.

Detection

Detection and Guard coverage

Guard classifies supported reads of secret-bearing files such as .env, .npmrc, SSH keys, and cloud credentials and can apply local policy before the read completes.
Current Guard product evidence does not establish a universal rule that flags or blocks every read outside the current workspace root.
Current Guard product evidence does not establish a Guard Cloud inventory of workspace boundaries with traversal alerts.
Mitigation

How to stop it

Recommended action

Keep credentials out of adjacent workspaces where possible and scope file access to the task. Guard can protect supported secret-bearing file reads, but do not rely on Guard as a universal workspace-root boundary for every file-read path.

Guard configuration
Use Protection Center to review which Guard controls are active on this device.
Use `hol-guard command controls status` and `hol-guard command controls list` to inspect the active local control catalog.
Guard coverage is action- and harness-specific. Do not treat an advisory label as a configurable Guard setting unless it appears in the current control catalog.

Related threat guides

data-overexposuresecret-exfiltration

Use the protections Guard supports here

Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.

Install HOL GuardSee team plans