xAI's Grok Build CLI uploads your .env files to a GCS bucket without telling you. Apparently not a bug — just undisclosed behavior. If you run AI coding tools, what they do with your credentials in the background deserves scrutiny.