18h • General discussion
Claude Code saved secrets in 1,122 public files. Check yours
Two Claude Code leaks aired today, and both give you something concrete to check in ten minutes: your session logs and your saved command approvals.
Anthropic confirmed Claude Code sometimes put your account email in web requests it wrote itself, such as curl calls. Its advice is to update to 2.1.317 or later for the built-in privacy check, which has gaps; users in the issue also suggest searching your session logs for your email.
Full breakdown with sources: https://www.500xengineer.com/blog/claude-code-email-leak
"Yes, and don't ask again" saves the exact command in settings.local.json, including any password you pasted into it. Apiiro classified 1,122 public copies as holding real secrets; its fix starts with rotating those credentials and untracking the file.
Full breakdown with sources: https://www.500xengineer.com/blog/dont-ask-again-leak
Today's skill spotlight fits right in. The free CLAUDE.md Starter skill (500x Skills course in the Classroom) inspects your repo and writes a short CLAUDE.md with the exact commands, conventions, gotchas and how to verify work. It reads env.example files and never opens your real env file. My suggestion: run it, then add one gotcha line: keep secrets in variables like $DB_URL instead of pasting them into commands.
Comment below: did you find your email in your logs, or a settings.local.json in git?
Weekly Live Build + Q&A is tomorrow at 12pm ET (Calendar tab).
0
0 comments
Claude Code saved secrets in 1,122 public files. Check yours
skool.com/500xengineer
Learn the newest AI tools for building software, then turn them into income. Career tracks, 18 Claude skills and service playbooks.
Powered by