Bubblewrap: A nimble way to prevent agents from accessing your .env files