Don't Feed Secrets to the Model: Simon Willison Built an Out-of-Band File Editor from His Phone with Codex

In the agent era, the most dangerous line of configuration might be the API key you casually paste into a prompt. The more capable models get, the more we feed them: entire repos, technical docs, server configs… and credentials files. On October 12, Simon Willison — one of the most respected independent observers in the AI coding world — shipped a small tool, web-edit 0.1a0, aimed at exactly this problem: editing a credentials file without letting the secrets "pass through" the LLM's context. And the most interesting part: the tool itself was built by Willison directing Codex Remote from his phone, with GPT-6 Astra Extra High doing the writing.

This is a release worth reading closely. The tool is small, but the problem it addresses cuts into everyone's daily life in the age of agent collaboration — as we hand more and more work to agents, "what must never enter the model's context" is becoming a new security boundary. Willison turned that boundary into a handy tool with a weekend-scale side project.

What the tool actually is

web-edit is a small Python web app with a reassuringly short feature list: browse files in a folder, view file contents, edit, upload. That's it. No user accounts, no plugin ecosystem, no AI features — it is valuable precisely because it has no AI in it.

The editor is CodeMirror 6. Willison originally wanted Monaco (the same editor behind VS Code), but Monaco's mobile experience is still not good enough, so it got dropped. That detail says a lot: the whole tool is designed around the phone as the primary device. The deployment target is equally explicit: run it on your Tailscale network. The standard workflow: have an agent start the web-edit service on a remote machine, then connect directly from your phone over Tailscale to edit files. The agent does the heavy lifting; you do the final human confirmation on your phone — and the "out-of-band channel" in between is what the credentials files travel through.

web-edit's file browser: file name, size and modification time at a glance, with Download / Delete / Upload / New file all present. The interface is plain, but every button serves the "edit files from your phone" scenario.

The screenshot shows what it looks like: a WORKSPACE / Files header with Refresh, Upload files and New file buttons; a file list with Name, Size and Modified columns, each file carrying Download and Delete links; an upload queue panel at the bottom with drag-and-drop support. Images under 2MB even preview inline. Not a single unnecessary design decision — this is a tool written to be handy for its author, open-sourced as a side effect.

The motivation is the thesis: a human-machine boundary problem

Willison's reason for building it is concrete: while working on a project from his phone using Codex Remote, he wanted to edit a credentials file without round-tripping those credentials through the LLM itself. So he had Codex and GPT-6 Astra Extra High build web-edit on the spot.

Behind that sentence sits an underestimated problem: the "human-machine boundary" in agent collaboration. Once sensitive information enters a model's context, you lose control of it — it can be stored in conversation history, used for training, written into some log, never to be retrieved. The traditional answer is "don't give secrets to the agent," but the reality is that agents increasingly need to operate real environments: editing configs, rotating secrets, handling deployment scripts with credentials. Between "give nothing" and "give everything," we need a middle road.

web-edit's answer is the out-of-band channel: sensitive files travel a different route that never passes through the model. The agent can start the service remotely and handle the non-sensitive parts, while editing the credentials file happens over a direct channel between you and the server — the LLM never sees the plaintext. This complements our site's guide "Don't hand your keys to AI": that guide covers credential-management SOP (secrets in vaults, environment variables, least privilege); this one turns the SOP into a small tool you can build in a weekend. Everyone knows the principle; what's usually missing is this last step of a handy implementation.

Why now: the trust model of agent collaboration is shifting

web-edit arriving in October 2026 is no accident. Over the past year, a key change happened in how agents work: from "writing code in a sandbox" to "doing work in real environments." Codex, Claude Code and their peers now routinely operate your repos, run your tests, call your APIs, and modify your infrastructure configs. The more capable they get, the larger the surface of sensitive information they touch — .env files, cloud access keys, database connection strings, OAuth client secrets. These used to live only in your password manager; now agent workflows pass by them every day.

That creates a new trust-model problem: the old security boundary was "human vs machine," and now it's a three-party game of "human vs agent vs model." The agent is your extension and deserves a degree of trust; but the model (the LLM itself) is a third-party service, and every prompt you send is data leaving your perimeter. web-edit's cleverness is that it doesn't try to solve the grand question of "should we trust the agent" — it makes one precise cut: extract the small set of most sensitive operations from the model's data flow. The agent works as usual; the model never sees the secrets. The trust model goes from "all or nothing" to "graded isolation."

This thinking echoes practices in the MCP ecosystem: secrets live in the MCP server's environment variables, held by the server, while the model only gets call results, never plaintext. web-edit applies the same "minimum exposure" principle to a more everyday scenario — editing files. The principle isn't new, but landing it in a concrete tool "usable from your phone" is new value.

Getting started and safety notes: use an alpha like an alpha

Trying it is a short path: pip install web-edit from PyPI, start the service on the target machine, make sure that machine is on your Tailscale network, then open the intranet address from your phone's browser and edit away. Willison's design assumption is "only you can reach it" — Tailscale's identity authentication is its access control.

But a few ugly truths first. One: this is 0.1a0, and the author himself makes no stability promises. Don't treat it as a production tool, and never expose it to the public internet — a file editor with no authentication layer hanging on the public web is roughly equivalent to gifting away your server's root. Tailscale is mandatory, not optional. Two: it solves exactly one problem — "secrets don't enter the LLM context" — not a full security program. Transport security comes from Tailscale; hardening the machine itself and managing file permissions are still your job. Three: keep an extra pair of eyes when editing credentials files. The out-of-band channel only guarantees the model can't see them; misconfigure something and it still blows up the same way. Back up before editing.

Also worth noting is the author's own weight. Simon Willison is a Django co-creator and the author of Datasette, and has spent two decades making data and tools usable for ordinary people. His writing on AI coding has a signature trait: never chasing hype, only writing about things verified in his own real workflow. A small tool he has personally used and deemed "worth shipping" carries a credibility no press release can match. That's also why VibeFix is covering this story: what matters isn't how powerful web-edit is, but the way of working it represents — building small tools for your own real pain points. That is exactly the nourishment the vibe coding community needs most.

Four takeaways for vibe coders

First, make secrets hygiene muscle memory. Credentials, .env files, private keys, tokens — they don't go into prompts by default. That's the iron rule. Out-of-band editing is just one solution; the more thorough fix is architectural isolation: secrets go into vaults or environment variables where the agent never sees plaintext, and scenarios needing agent operation get least-privilege temporary credentials. The next time you're tempted to paste your .env into a chat box and ask the agent to "check if my config is right," pause for one second — Willison's little tool is the answer prepared for exactly that second of hesitation.

Second, the Tailscale pattern is worth copying. Intranet service + direct phone access: the agent runs in the cloud, and you do the final human confirmation from anywhere on your phone. It's a lightweight implementation of "human-in-the-loop": no complex approval system needed, one encrypted tunnel plus a web UI suffices. Many solo-dev workflows can reuse this template: extract the "needs human eyes" steps into a phone-reachable intranet service instead of pasting back and forth in a chat box.

Third, the small-tool philosophy. web-edit solves a tiny problem (editing files) but cuts precisely. A vibe coder's advantage was never building big systems — it's turning these "small annoyances" into handy tools within an hour, with yourself as the first user. Willison's blog over the past year is full of side projects in this style: problems from real workflows, solutions small enough to write in a weekend, used by himself immediately. This "build tools for yourself" loop is the healthiest form of vibe coding: real demand, instant feedback, no PM scheduling required.

Fourth, the shipping mindset. Shipping at 0.1a0, with alpha status stated plainly. Many indie developers (myself included) suffer from "polish it a bit more before release" procrastination, and Willison's example is the counterexample: a tool's value lies in being used, not in being perfect. A weekend-built out-of-band editor can already help you edit credentials files safely today — while that "perfectly polished" version may sit on your todo list forever.

web-edit won't change the world; it doesn't even want to. It just draws a small, clear boundary in the agent era: some things should not pass through the model. The sooner that boundary becomes habit, the more auditable your agent workflows become — and the better you sleep. And the best security habits often look exactly like this: not a 20-page policy document, but a small tool built over a weekend that you use every day.