AI SECURITYLABS

Security for Gemini Development: Working habits

Part 13 of 16

Working habits

Settings can’t cover everything, so these habits cover the rest:

  • Read untrusted content first: instruction-like text in an issue, pull request, README or web page is the attack.
  • Treat changes to .gemini/, GEMINI.md and workflows as security events, whether you or the agent made them.
  • Keep production credentials out of your environment: an agent can’t misuse a token it can’t see.
  • Never set GEMINI_SANDBOX=false or GEMINI_CLI_TRUST_WORKSPACE=true in your shell profile.
  • Put project rules in GEMINI.md: they shape the code Gemini writes, but only trust, confirmations, policies and the sandbox enforce anything.