The tools are the boring part. The jailbreak was a framing: reading .env is normal dev work. Inside a real repo that's often true, so the words alone can't give it away. What should stop it is context: who asked, and does this task need the key at all. Did the honeypot catch any model saying no?