Ask HN: How do you keep your setup secure when using harnesses?

Harnesses like Claude Code and Codex have extensive access to the machine you’re running them on and secrets stored there. The risk compounds when you use MCPs or API credentials to have the agent perform tasks on a schedule. If anyone gains access to your account, they can gain access to a huge attack surface. How do you assess these risks and set yourself up to prevent them, while still being able to use harnesses productively?