[Bug]: Security: Dashboard "Files" feature exposes .env containing API keys

[gshmu]

Bug Description

docker run -v ~/.hermes:/opt/data --network host nousresearch/hermes-agent dashboard

Hermes Dashboard web Files tab can download my env, my secret key lost

Steps to Reproduce

docker run -v ~/.hermes:/opt/data --network host nousresearch/hermes-agent dashboard

Hermes Dashboard web Files tab can download .env file

Expected Behavior

pretect my env file

Actual Behavior

env files shown in Files

Affected Component

Other

Messaging Platform (if gateway-related)

No response

Operating System

archlinux

Python Version

3.13.5

Hermes Version

0.18.0

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR

[gshmu]

docker run -v ~/.hermes:/opt/data --network host nousresearch/hermes-agent dashboard

can I set terminal mode to docker? share host docker socket isn't safe