The agent reads your .env. So does the prompt cache.

I built drape because the obvious fixes — don't have .env in the repo, use a vault, gitignore harder — don't help when the agent is the thing doing the reading.