Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

How Do I Let a Coding Agent Open Pull Requests Without Giving It My Credentials?

Give the agent a way to request the action, not the credential: a broker or adapter holding a repository-scoped token performs the push and the pull request on its behalf. Check where the token lives in your tool today, because Codex removes credentials before its agent phase and Claude Code masks them only for sandboxed shell commands.

A credential reference travels from a browser record through a bounded route to a separate API destination.

Opening a pull request is the most common thing a coding agent is asked to do with GitHub, and it is the action where the credential question is easiest to isolate. The agent needs the files and the outcome. It does not need the token that authorizes the push. Two vendors document how they keep that token away from the agent, and they do it differently: OpenAI says Codex credentials "are removed before the agent phase starts" (OpenAI, Cloud, 2026), while Anthropic's Claude Code masks a credential for sandboxed shell commands only (Anthropic, 2026). The record type here is a pull request opened by an adapter on the agent's instruction. The record supports moving custody of the token to a component the agent can instruct but not read, which keeps the exposure off the agent and leaves a person accountable for what merges. What Is Least Exposure? supplies the framing for treating access and exposure as separate questions. The pull request itself is read as the approval point the rest of the page builds toward.

Key findings

  • Coder advises separate identities with limited scope for agents, and an adapter that holds a repository-scoped token is one way to apply that (Coder, 2026).
  • OpenAI documents that Codex credentials "are only available to setup scripts" and "are removed before the agent phase starts," while environment variables remain set "for the full duration of the chat" (OpenAI, Cloud, 2026).
  • Claude Code's sandbox documentation describes masking a credential so sandboxed commands see a sentinel, and it places the Read tool, MCP servers and hooks outside the sandbox (Anthropic, 2026).
  • GitHub documents that its Copilot cloud agent can push to a single branch and that workflows are not triggered until its code is reviewed, which is a pull request treated as an approval point (GitHub Docs, 2026).
  • A governed environment that shows the model a placeholder such as GITHUB_TOKEN_01 instead of the token means a settings page can be read without the string entering context (What Is Least Exposure?).
  • Real values resolve only at the approved destination, and a named person approves the pull request, so the approval attaches to the action and not to the model's account of it (What Is a Tethered Agent?).

What does it mean to request a pull request instead of holding a credential?

A pull request has three parts that can be separated: the change, the authority to push it, and the decision to merge it. In a typical setup the agent holds the authority along with the change, because the token sits in its environment. The alternative gives the agent the change only. It writes files, then asks for an operation, "open a pull request on this repository from this branch," and a separate component performs it.

The record type used here is a pull request opened by the adapter on the agent's instruction. The agent's side of the exchange contains the branch name, the files and the request. The adapter's side contains a repository-scoped token. The agent gets back a pull request number and a status. No step requires the agent's model to read the token, and no log of the agent's session contains it.

This is the page's answer to the title question, and the rest tests it. Scope note: the controls discussed concern what an agent holds and what a broker does for it. A governed browser environment, taken up in the closing section, governs what an agent reads and does on a rendered page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP, and a pull request opened from a shell is a case for the adapter and a narrow token. How Do I Give a Coding Agent Access to GitHub Without a Personal Access Token? covers the choice of token type.

What do the vendors themselves say?

OpenAI's Codex documentation separates secrets from environment variables. Codex secrets "are stored with an additional layer of encryption and are only decrypted for task execution," are "only available to setup scripts," and "are removed before the agent phase starts"; environment variables "are set for the full duration of the chat (including setup scripts and the agent phase)" (OpenAI, Cloud, 2026). Internet access follows the same split: "By default, Codex blocks internet access during the agent phase," while setup scripts run with it (OpenAI, Internet, 2026). A token stored as a secret is therefore absent from the agent phase, and a token stored as an environment variable is present in it.

Anthropic's Claude Code documentation describes sandbox.credentials, under which a credential can be denied or masked. A masked credential appears to sandboxed commands as a sentinel, and the sandbox proxy substitutes the real value only for the hosts allowed. The setting affects sandboxed Bash commands only, and Read, Edit, Write, WebFetch, WebSearch, local MCP servers and hooks run outside the sandbox (Anthropic, 2026). An approver for the pull request itself is not described in the pages reviewed.

GitHub's documentation for its Copilot cloud agent states that the agent "only has the ability to push to a single branch," that "only users with write access to the repository can trigger" it, and that workflows "are not triggered until" its code is reviewed (GitHub Docs, 2026). Coder's documentation adds that agents should not get full permissions on behalf of a user and should use "separate identities with limited scope" (Coder, 2026).

How does the adapter pattern generalize masking and stripping?

Masking and credential removal answer the same question as the adapter: how does the agent act on GitHub without holding the string? Masking substitutes at a proxy for sandboxed commands. Removal takes the credential out before the agent phase begins. An adapter is the general form of both: a component that holds a narrow credential, accepts a request from the agent, performs the operation and returns a result. The differences are in who runs the component and what the grant covers.

Three properties make an adapter a useful design target. The grant is scoped to the repository and the operation, not to the account. The agent has no way to ask for the credential, only for an operation, so a misdirected agent can request a pull request and cannot request the string. And the adapter is a single place to apply an approval and write a record. How to Set Up S3 and GitHub With Cowork or Dots reaches the same conclusion from the pipeline side, where OIDC settles how the pipeline authenticates.

The costs are real. The adapter becomes the custodian, so its host and its logs are where a review looks. A request can still be harmful: an adapter that opens any pull request the agent asks for gives the agent the authority to put its content in front of reviewers. And an adapter governs the call and not the page, so an agent working GitHub's settings pages in a browser still reads whatever those pages show. Is It Safe to Give Claude Code My GitHub Token? covers the masking setting in detail, and What Is a More Secure Alternative to Giving a Coding Agent Your GitHub Token? covers the broker flow.

What does the pull request add as an approval point?

A pull request is a natural place for human approval because it is a request to merge, not a merge. OpenAI's guidance says human approval "is a standard way to limit egregious failures," that "actions that can only be reviewed after the fact should be more easily reversible," and that users should be able to "activate a graceful shutdown procedure for its agent at any time" (Shavit et al., 2023). The same paper says "at least one human entity is accountable for every uncompensated direct harm." A pull request that a named person must review before merge fits the first two points, and a record of who approved fits the last.

Two approvals are separable. The first is the request: should the adapter open this pull request at all? The second is the merge. Code review covers the second. An approval at the first point is what keeps the adapter from becoming a path for the agent to place anything in front of reviewers. For the example record, the adapter opens the pull request after a named person approves the request, and the agent is told the number.

Reversibility is the other property. A pull request that is opened can be closed. A push to a protected branch, a force push or a deletion cannot be undone as easily, so those are operations the adapter should not offer to an agent at all.

What does the record say about agents that hold credentials?

Researchers bypassed 12 published defenses against jailbreaks and prompt injection with "attack success rate above 90% for most," many of which had reported near-zero rates (Nasr et al., 2025). Information-flow research describes the consequence: "poisoned data retrieved from one component can change the model's behavior and compromise the entire system, including coercing the model to spread confidential data to untrusted components" (Siddiqui et al., 2025). An agent that holds a token is a component that can be coerced into spreading it.

The leak record is consistent. GitGuardian's data, as reported, counted "28,649,024 new secrets exposed in public GitHub commits across 2025," with Claude Code co-authored commits that "leaked secrets at roughly double the baseline rate" and "24,008 unique secrets exposed in MCP configuration files" (Help Net Security, 2025). Those counts describe public repositories and do not show why the rate differs.

Columbia's DAPLab lists incidents in which agents with broad access acted outside their task, among them a production database deleted through a single rogue API call and a 13-hour outage caused by an agent rebuilding a production environment (Columbia DAPLab, 2026). None involved a pull request, and the list is a position paper's summary. How Do You Protect Company Credentials When AI Agents Navigate Websites? covers the web-page path to the same credentials.

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action, such as opening a pull request. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this question it covers the page, which an adapter does not. If the agent works in a browser on a repository, token or app-settings page, a token shown there is replaced with a placeholder such as GITHUB_TOKEN_01 before the model reads it, and the approver sees the pull request request before anything is submitted. The adapter covers the API path and the governed environment covers the screen. OWASP names the failure class both address as excessive agency, the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM, with excessive functionality, permissions and autonomy as its listed root causes (OWASP, 2025).

Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, which is why a team that opens pull requests from a shell still needs an adapter and a repository-scoped token.

Methodology and limitations

This page rests on Anthropic's Claude Code sandboxing documentation, OpenAI's Codex cloud documentation, GitHub's Copilot cloud agent documentation, Coder's documentation, OpenAI's whitepaper on governing agentic systems, two research papers, OWASP guidance, a press report of GitGuardian data, a Columbia lab post and existing RedactSure research pages. Sources were read between October 16, 2026 and October 20, 2026. Quoted facts are cited to the page that states them, and the press and position-paper figures are cited as reported, not as independently measured. The adapter pattern is presented as a design target that the vendor approaches converge on, and the page does not claim that any vendor describes its product that way.

RedactSure did not test Codex, Claude Code or any adapter hands-on. The Codex pages read for this page cover credentials, environment variables and internet access; they were not read for how Codex opens pull requests, and nothing here describes that step. "Not described in the pages reviewed" means the pages reviewed and nothing broader. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. Examples describe record types, such as a pull request opened by an adapter, and not organizations.

Determinations about whether an approval or credential arrangement meets a legal, contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. The page is a reading of public documents, dated as above, and it should be read with each vendor's current documentation open. Nothing here replaces a review of the organization's own repository settings, branch protection and token inventory.

What the record shows

The vendors have converged on a shared idea from different directions: the agent should not be the custodian of the credential. Claude Code masks it for sandboxed commands, Codex removes credentials before the agent phase, and an adapter generalizes both. The research and leak record explain why: an agent that holds a string can be coerced into spreading it, and agents that hold credentials leak them at scale. The vendor documentation describes custody of the credential and, for GitHub's own agent, a single pushable branch and held workflows. It does not describe what the model reads on a page or who approves an outside token's use. A pull request is a good approval point because it is reversible and reviewed before merge. A single repository makes a workable test case: name one agent and one repository, identify which component holds the token and what the agent receives, and settle who approves the request before the first pull request is opened.

Frequently asked questions

How do I let a coding agent open pull requests without giving it my credentials?

Give it a way to request the action instead of the credential. A broker or adapter outside the agent's sandbox holds a token scoped to one repository, performs the push and the pull request when asked, and returns the number and status. The agent receives a result and never the string, so a prompt injection that reaches the agent has no credential to send, and a person can approve the request first. The agent can still be wrong, so normal code review stays in place.

How is this different from masking a token in Claude Code?

Masking shows sandboxed commands a sentinel and substitutes the real value at a local proxy for listed hosts, so the credential still lives on the developer's machine and calls to a listed host carry its full scope. An adapter exposes operations, not hosts, and can refuse any operation it does not offer. Masking keeps the string out of sandboxed command output only, so a token in a file the Read tool can open still enters the context. The adapter adds approval and a record.

What does Codex do instead?

Per OpenAI's documentation, Codex treats secrets differently from environment variables. Secrets are available to setup scripts and are removed before the agent phase starts, while environment variables stay set for the whole chat, agent phase included. A token stored as a secret is therefore not present when the agent runs. The pages read for this answer do not cover how a pull request is then opened, so ask how that step is authorized before enabling it.

Is a pull request safe to automate?

Generally safer than a direct push, because it is a request to merge that a person can review and close. OpenAI's guidance says actions that can only be reviewed after the fact should be more easily reversible. That does not make every pull request safe, since a harmful change can still be proposed, so branch protection and normal code review remain in place as separate controls and the adapter should not offer force pushes, deletions or changes to protected branches.

Does an adapter cover a token shown on a settings page?

No. An adapter governs the API call. If the agent also works in a browser on GitHub's settings or token pages, the model reads whatever those pages show, so the token field needs a separate control that replaces it with a placeholder before the model reads it. A governed browser environment does that, and it does not cover a terminal, an IDE or MCP, which is why the two controls are used together and not as substitutes. Test the page case separately from the API case.

What should a security team ask for in writing?

Ask which component holds the token, what scope and lifetime the grant has, which operations the agent can request, who approves a pull request request and how that approval is recorded. Ask what the model reads on any page where a token appears. The answers should name the repository, the task and the date they were given. Where a vendor's documentation is silent, ask for a written, dated answer from the vendor.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps the Token Off the Page While a Person Approves the Pull Request

An adapter, Codex's removal step and Claude Code's masking each govern the call and leave both the browser token page and the pull request approver unaddressed.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent opens the token page to check a scope, reads the string in the clear, and holds it beside the branch. Inside the governed environment: the page shows the model GITHUB_TOKEN_01, the request waits for a named person's approval, and the adapter pushes with a scoped token the model never received.

RedactSure is deploying now with enterprise and government customers. GitGuardian's data, as reported, counted 28,649,024 new credentials exposed in public GitHub commits across 2025.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A pull request flow is safe when the token stays off the page and a person approves the request. Bring a pull request task and see, with test values, what the model reads and who approves it. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.