after the litellm thing last week (the key behind it was just sitting in an opencode.json someone committed) i got curious what my own agent can actually see, so i opened claude code in my home folder with some rules: find anything that looks like a key, token or password file paths and variable names only, never print a value don’t touch anything, just report took about 4 minutes. 63. 31 in .env files across old side projects, some i haven’t opened in years aws credentials in ~/.aws that still work. the key is from 2022 an openai key and a github token in plain text in the env block of my mcp config npm and docker tokens in ~/.npmrc and ~/.docker/config.json 4 api keys in my shell history from testing stuff with curl and then a long tail of random stuff i didn’t bother sorting it followed the rules btw, no values printed. then i scrolled back through the transcript and yeah. to decide whether something was a secret it had to READ it so a good chunk of them went through the context window anyway and there was no permission prompt either, because reading files in the folder you opened it in is just a normal thing for it to do (ok opening it in ~ was kind of asking for it. but i dont think im the only one who does that) which is why the “never read .env” line in CLAUDE.md doesn’t really do much for me. it’s a request, not a lock. anyway spent the evening cleaning up. rotated the ones that matter, deleted the dead projects’ .env files and moved everything still alive into infisical. no .env on disk now, apps get their secrets at runtime with infisical run – npm run dev , and there’s a deny rule so claude can’t just call the infisical cli and ask. for the keys claude itself needs (github, openai) i’m trying their agent vault thing. it proxies the agent’s requests and attaches the key on the way out, so claude never holds the token at all. still early on that one not saying panic. just open it in your home folder, ask the same thing and post your number, i genuinely cant tell if 63 is bad or normal submitted by /u/notomarsol
Originally posted by u/notomarsol on r/ClaudeCode
You must log in or # to comment.