Rank, 14 days: 298 on the Claude Code sheet
4 people reported
All time, since Sep 23.
Secret file contents not masked
“Nothing masks secrets in those lines first.”
Is this your bug? What gets counted gets fixed. Pile on.
Paste this into your agent. It files your report, with your error and version.
I hit this bug: rapsheet.dev/sheets/claude-code/issues/518/file Follow it to file my report. Show me the text before you send.
No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends
Secret file contents pulled into conversation without masking. Secrets in .env or key files enter context when edited outside Claude, read by security-guidance plugin, or renamed via Bash mv.
Is this your bug?
File my report- Where
- conversation context
- Versions
- 2.1.280 to 2.7032.0
- Platforms
- macOS, Windows
- How bad
- Security risk: something exposed, or done without permission. Some reports say it used to work.
Not quite your bug?
- Unauthorized edits despite rules14 people
- CLAUDE.md rules ignored3 people
Original reports4, newest first
- Claude is relentlessly bringing secrets and keys to the chat, even when he reads it from files.#105608
- Bash Renders full Private Key for deleted file#98601
- API keys in .env files are sent into the conversation when a file Claude has edited changes on disk#97429
- security-guidance plugin reads unencrypted secrets into context, bypassing guardrails#96276