/setup-security.en

description: "Lesson command"
duration: "~5 min"
prerequisites: ["ai-agent-camp folder is open in Cursor"]
level: "beginner"
tags: ["setup", "security"]
nonInteractiveMode: deferred

/setup-security -- Automatic Security Settings Setup

Step 0: Check Setup Progress

**What the AI auto-runs:** 1. Run `uv run python tools/setup_progress.py show --current setup-security` to display progress 2. Check if already configured:

• Whether `.gitignore` is properly set up
• Whether a pre-commit hook is set up
• If both are configured, ask "Security settings are already complete. Would you like to skip?"

What This Command Does

This command **automatically sets up security settings to prevent secrets like API keys and passwords from being accidentally published to GitHub**. The AI handles everything behind the scenes. You do not need to use the terminal at all. Everything is executed automatically by the AI.

| Item | Details | |------|---------| | Goal | Automatically configure .gitignore and pre-commit hooks to prevent secret leaks | | Duration | ~5 minutes | | Prerequisites | ai-agent-camp folder is open in Cursor | | User action | Just press buttons (no CLI commands needed) |

---

Why Do You Need Security Settings?

> **Let's explain with a familiar example:** > > Imagine you wrote your "house key code" on a notepad and left that notepad on a park bench -- anyone could get into your home, right? > > An AI service's "API key" is equivalent to that "key code". If an API key is published on GitHub (an online code repository): > > - **Others can misuse your API key** (massive requests sent under your account, potentially resulting in high charges) > - **Personal or company data could be leaked** > - **Your account could be taken over** > > This security setup creates a **mechanism that automatically prevents accidental API key exposure**.

---

Readiness Check

**AskQuestion configuration:**

{
  "title": "Let's begin security setup",
  "questions": [{
    "id": "readiness",
    "prompt": "Are you ready?",
    "options": [
      {"id": "ready", "label": "Let's start"},
      {"id": "more_info", "label": "I'd like to know more details"},
      {"id": "different_lesson", "label": "Go to a different lesson"}
    ]
  }]
}

(ready -> Proceed to Step 1) (more_info -> Display the following)

> **Three safety mechanisms this command sets up:** > > 1. **.gitignore** -- A list that tells Git "don't upload these files to GitHub". It excludes .env files that contain API keys from being uploaded. > > 2. **pre-commit hook** -- A mechanism that automatically runs a "are you sure?" check right before uploading to GitHub. If you accidentally try to upload a file containing API keys, it automatically blocks it. > > 3. **Current status check** -- The AI automatically checks whether any API keys have already been exposed.

(different_lesson -> Show module list)

---

Step 1: Check and Configure .gitignore

**What the AI auto-runs:**

1. Read the `.gitignore` file in the project root 2. Check whether the following entries are included:

# Secrets (API keys and tokens)
.env
.env.local
.env.*.local

# Credentials
credentials/
*.key
*.pem

# OS-generated files
.DS_Store
Thumbs.db

3. **If any entries are missing**: Automatically add them to `.gitignore`

4. Display results to the user:

Checked .gitignore.

| Exclusion rule | Status | Description |
|---------------|--------|-------------|
| .env | Added | API key file |
| .env.local | Added | Local environment variables |
| .env.*.local | Added | Environment-specific local variables |
| credentials/ | Added | Credentials folder |
| *.key | Added | Private key files |
| *.pem | Added | Certificate files |

Updated .gitignore.
This prevents secrets like API keys from being published to GitHub.

5. **If all entries are already present**:

.gitignore is already properly configured. No additional changes needed.

**Note: All file checking and editing is done automatically by the AI. The user does not need to enter any commands.**

---

Step 2: Set Up pre-commit Hook

**What the AI auto-runs:**

1. Check whether `.git/hooks/pre-commit` exists 2. If it doesn't exist, or doesn't include .env checking, create it with the following content:

#!/bin/sh
# Security check: Block commits containing secret files
# This hook was auto-generated by the /setup-security command

# Block commits of .env files
BLOCKED_FILES=$(git diff --cached --name-only | grep -E '^\\.env$|^\\.env\\.|credentials/|.*\\.key$|.*\\.pem$')

if [ -n "$BLOCKED_FILES" ]; then
    echo ""
    echo "============================================"
    echo "  Security Warning: Commit was blocked"
    echo "============================================"
    echo ""
    echo "The following files may contain secrets:"
    echo "$BLOCKED_FILES"
    echo ""
    echo "Publishing these files to GitHub could result in"
    echo "API key misuse or data leaks."
    echo ""
    echo "How to fix:"
    echo "  1. Run git reset HEAD <filename> to unstage"
    echo "  2. Only if absolutely necessary, use git commit --no-verify to force commit"
    echo ""
    exit 1
fi

3. Grant execute permissions (AI runs `chmod +x .git/hooks/pre-commit` behind the scenes)

4. Display results to the user:

Security hook has been set up.

This will automatically block accidental commits of the following files:
- .env (API key file)
- .env.local / .env.*.local (environment variable files)
- Files in the credentials/ folder
- *.key / *.pem (private keys and certificates)

If you accidentally try to commit these files,
a warning message will appear and the commit will be stopped, so you're safe.

5. **If the hook is already set up**:

pre-commit hook is already configured. No additional changes needed.

**Note: All file creation and permissions are handled automatically by the AI. The user does not need to enter any commands.**

---

Step