Hide your project .env files from coding agents. Byte-copies real values into ~/.eeenv/vault/, then replaces local files with random tokens. When you're done, restore everything with one command.