Skip to content

[BUG] <system-reminder> can read sensitive selected text from .env files, no hooks available to protect our files #20305

New issue
New issue
Closed as not planned
Closed as not planned
[BUG] <system-reminder> can read sensitive selected text from .env files, no hooks available to protect our files#20305
Labels
area:idearea:securitybugSomething isn't workinghas reproHas detailed reproduction stepsplatform:windowsIssue specifically occurs on WindowsstaleIssue is inactive

Description

@harli91
harli91
opened on Jan 23, 2026

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

sensitive selected text is available to claude

What Should Happen?

sensitive selected text should not be available to claude

Error Messages/Logs



Steps to Reproduce


    

  1. create .env file
    2. 

  2. open the file in a ide
    3. 

  3. add sensitive content to .env and then select it
    4. 

  4. open claude
    5. 

  5. ask it what is the value of the text that its selected
    6. 

  6. it will display the sensitive value
    7. 



Claude Model


None


Is this a regression?


Yes, this worked in a previous version


Last Working Version


No response


Claude Code Version


2.1.17 (Claude Code)


Platform


Anthropic API


Operating System


Windows


Terminal/Shell


PowerShell


Additional Information


No response
Activity
  1. harli91
    added 
    bugSomething isn't working
     on Jan 23, 2026
  2. github-actions
    added 
    has reproHas detailed reproduction steps
     
    platform:windowsIssue specifically occurs on Windows
     
    area:security
     
    area:ide
     on Jan 23, 2026
  3. github-actions commented on Jan 23, 2026 
    @github-actions
    github-actionsBot
    on Jan 23, 2026 – with GitHub Actions
    Found 3 possible duplicate issues:
    

      

    1. Claude overreacts to IDE text selections/highlights #18219
      2. 

    2. [BUG] Claude displayed sensitive .env credentials (API keys, secrets) in output when it should have redacted them. #18223
      3. 

    3. [BUG] Security Bug Report: Claude Code Exposes Sensitive Environment Variables When Confused #19278
      4. 

    

    This issue will be automatically closed as a duplicate in 3 days.
    

      

    • If your issue is a duplicate, please close it and 👍 the existing issue instead
      • 

    • To prevent auto-closure, add a comment or 👎 this comment
      • 

    

    🤖 Generated with Claude Code
  4. github-actions
    added 
    staleIssue is inactive
     on Feb 13, 2026
  5. github-actions commented on Feb 27, 2026 
    @github-actions
    github-actionsBot
    on Feb 27, 2026 – with GitHub Actions
    Closing for now — inactive for too long. Please open a new issue if this is still relevant.
  6. github-actions
    closed this as not plannedon Feb 27, 2026
  7. github-actions commented on Mar 9, 2026 
    @github-actions
    github-actionsBot
    on Mar 9, 2026 – with GitHub Actions
    This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.
  8. github-actions
    locked as resolved and limited conversation to collaborators on Mar 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Metadata
Metadata
Assignees
No one assigned
    Labels
    area:idearea:securitybugSomething isn't workinghas reproHas detailed reproduction stepsplatform:windowsIssue specifically occurs on WindowsstaleIssue is inactive
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions