How do I make Gradle repository credentials inacce...
# community-supports
Sergej Koščejev
10/20/2026, 5:40 PMHow do I make Gradle repository credentials inaccessible to agents? E.g. one agent ran
gradlew properties👀 1
v
Vampire
10/20/2026, 6:00 PMI don't think you can as long as they are supplied in any way as project properties, including setting through environment variables like
ORG_GRADLE_PROJECT_zzzt
Thomas Broyer
10/21/2026, 6:16 AMCould there be any way that Gradle can read the credentials but the thing that run Gradle couldn't? I don't think so (even if Gradle didn't display the credentials in the properties task, one could use an init/settings/build script/plugin to read them the same way that Gradle does)
So: run sandboxed with no access to the credentials (which means every dependency from an authenticated repository must have been resolved outside the sandbox already)
s
Sergej Koščejev
10/21/2026, 6:17 AMI’m rather worried about accidental exposure than giving it credentials. E.g. gh CLI has my token but it won’t print it accidentally.
v
Vampire
10/21/2026, 6:25 AMWell, it was not accidental. The agent requested to have them printed. The agent could also decide to add an own task that prints the properties to support versions that do not have that task and would print it then even if the standard task suppresses them. And even if Gradle would filter in the output sensitive information, an agent could decide to write the properties into a file instead, to further process them. .....
Vampire
10/21/2026, 6:27 AMIt could even do the bad decision of reading the properties file directly. Would be wrong as various ways could overwrite the priorities, but AI is not really known for their great decisions, but for being able to trial and error until it might maybe have worked somehow on the happy path.
s
Sergej Koščejev
10/21/2026, 7:04 AMYes, we are no longer in the comfortable world of 0s and 1s, of allowed/denied, but rather in the world of probabilities. I would like to reduce the probability of an accident, being well aware that eliminating it completely needs a different design.
Sergej Koščejev
10/21/2026, 7:07 AMI find that frontier AI models do have some sort of intent and try to write commands and scripts in ways that avoid revealing secrets in general. But they can make mistakes.
Sergej Koščejev
10/21/2026, 7:07 AMAnyway, I’m going to try writing a hook that would redact secrets from tool outputs.
👌 1
v
Vlastimil Brecka
10/21/2026, 12:30 PMCredentials to what exactly, private maven repo?
s
Sergej Koščejev
10/21/2026, 12:30 PMyes
v
Vlastimil Brecka
10/21/2026, 12:33 PMI dont know the answer exactly, but maybe this helps, I recently started using docker sbx, a sandbox for the agent and there
1. you can control the network physically, so stuff cannot get exfiltrated
2. they have the same problem as you, they need to inject credentials into the sandbox (llm api key), and they were braging about how they made it secure, but idk details, but probably you can emulate that approach
Vlastimil Brecka
10/21/2026, 12:34 PMprobably some proxying