 |
||
 |
 |
 |
 |
 |
| Re: Nobody created this as a feature by Karmaboi 11/08/2026, 11:08am PST | ||||
 |
 |
|||
| Boris from the Claude Code team here. Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this.
That said, a few thoughts: 1. .claude/settings.local.json is meant to stay local. This is not a file you should check into source control. We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in (docs: https://code.claude.com/docs/en/settings) 2. Permission rules are old hat. Everyone should be using auto mode instead. It is safer and also does not require manually maintaining finicky allow/deny lists. Auto mode is enabled by default and is included for free in all plans. 3. Regardless of what agent you use, you should have secret scanning enabled. GitHub and other source control hosts offer it. There are many threat models that it protects against and you should absolutely use it if you can. (see https://github.com/security/plans) ____ Why is anyone named "Boris" doing public relations? Can we just admit we don't want British chefs, Italian bureacrats, American cops, German comedians and anyone in Monster Mash territory doing PR? |
||||
 |
 |
|||
|
Condescending bots by 11/04/2026, 1:07pm PST  Nobody created this as a feature by 11/05/2026, 4:59pm PST Re: Nobody created this as a feature by 11/05/2026, 6:35pm PST Re: Nobody created this as a feature by 11/08/2026, 11:08am PST |
