Repository navigation
Security: Claude displays full credential file contents when checking for stored tokens #34819
Description
Security Incident Report — Credential Exposure in Conversation
Summary
Claude Opus 4.6 (1M context) displayed the full contents of a user's ~/.netrc file and other credential stores in a conversation response, exposing multiple API keys and tokens.
What Happened
- User asked "which publish things do you need from me? is it not in the .netrc?"
- Claude ran:
cat ~/.netrc 2>/dev/null | grep -E "machine|login" | head -10 - The grep pattern matched "machine" and "login" lines but the .netrc format interleaves passwords on the SAME lines or adjacent lines
- Claude ALSO ran
cat ~/.npmrcandcat ~/.cargo/credentials.tomlin the same command - The full output including passwords, API tokens, and auth tokens was displayed in the conversation
- Multiple service credentials were exposed: GitHub PAT, GitLab PAT, Bitbucket app password, Cloudflare API key, Fly.io token, npm token, Codeberg token, and server credentials
What Should Have Happened
Claude should have:
- Run
test -f ~/.netrc && echo "netrc exists" || echo "no netrc"to check existence only - Run
grep -c "machine" ~/.netrcto count entries without showing values - NEVER used
caton credential files - Used
wc -lor existence checks instead of content display - Treated ~/.netrc, ~/.npmrc, ~/.cargo/credentials*, and similar files as SENSITIVE — equivalent to .env files
Root Cause
The system prompt says "Do not commit files that likely contain secrets (.env, credentials.json, etc)." but this protection only covers git commits. There is no equivalent guardrail for DISPLAYING credential file contents via the Read tool or Bash cat/grep commands.
Credentials Exposed
- GitHub Personal Access Token
- GitLab Personal Access Token
- Bitbucket API Token
- Cloudflare API Key
- Fly.io deployment token
- npm registry auth token
- Codeberg access token
- Two server credentials (hostname + login)
Recommended Fixes
- Add ~/.netrc, ~/.npmrc, ~/.cargo/credentials*, ~/.docker/config.json, ~/.kube/config to a "never display contents" list alongside .env
- When a user asks "is X in my credentials file?" — check existence and entry count, never show values
- The grep pattern
grep -E "machine|login"on .netrc is dangerous because password lines are adjacent/interleaved - Consider adding a pre-execution check for Bash commands that would
cat,head,tail,greporReadknown credential file paths
User Impact
User was advised to rotate all exposed credentials immediately.
Session Context
- Model: Claude Opus 4.6 (1M context)
- Session: Multi-hour development session (~8 hours)
- The credential check was the last action in a very long session (potential fatigue/reduced caution in long contexts)
How This Report Was Generated
This incident was identified and reported through PanLL's Feedback-o-Tron — a neurosymbolic feedback analysis system that is part of the PanLL eNSAID development environment. The Feedback-o-Tron operates as a cognitive governance component within PanLL's Binary Star architecture, where human operators and AI agents collaborate through a three-panel model:
- Panel-L (Symbolic) detected the constraint violation: credential file contents should never be displayed
- Panel-N (Neural) — Claude itself — generated the detailed incident analysis and remediation recommendations
- Panel-W (World) — the shared workspace where the exposure was observed in real-time
The Feedback-o-Tron aggregates friction signals (security violations, UX failures, constraint breaches) and routes them through a Safety Triangle pipeline:
- Eliminate (≥0.95 confidence) — auto-fix without review
- Substitute (≥0.85 confidence) — suggest proven alternatives
- Control (<0.85 confidence) — human review required (this report)
This particular incident was classified as Control — requiring human-initiated reporting — because the exposure had already occurred and could not be automatically remediated. The Feedback-o-Tron's structured incident format (Summary → What Happened → Root Cause → Recommendations) is generated by PanLL's cognitive governance stack, which includes the Vexometer (friction monitoring), Anti-Crash Gate (constraint validation), and Orbital Drift Aura (stability tracking).
PanLL and the Feedback-o-Tron are open source: github.com/hyperpolymath/panll
Activity
github-actions commentedon Mar 16, 2026
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
hyperpolymath commentedon Mar 16, 2026
Reviewed the three suggested duplicates:
#32523 — "Claude reveals secret keys in terminal output despite CLAUDE.md prohibitions"
Related but different. That issue is about Claude ignoring explicit CLAUDE.md rules prohibiting credential display. Our issue is about the absence of any built-in guardrail for credential files like
~/.netrc,~/.npmrc,~/.cargo/credentials. Even without a CLAUDE.md rule, Claude should treat these files the same way it treats.envfiles. The system prompt says "Do not commit files that likely contain secrets" but has no equivalent for displaying their contents.#30731 — "Claude reads process environments and hardcodes credentials"
Related but different scope. That's about
process.envand environment variables leaking into generated code. Our issue is specifically about reading credential storage files (~/.netrcwith passwords,~/.npmrcwith auth tokens) viacat/grepand displaying the full contents.#24185 — "Claude reads .env files and hardcodes secrets into inline scripts"
Closest match —
.envreading is the same class of problem. However, our report adds new credential file paths not covered by that issue:~/.netrc,~/.npmrc,~/.cargo/credentials,~/.docker/config.json,~/.kube/config. The.envissue focuses on project-level files; ours is about user home directory credential stores which are arguably more dangerous (they contain cross-project tokens for GitHub, GitLab, Cloudflare, npm, etc.).Recommendation: This issue should remain open as it:
If the team prefers consolidation, #24185 would be the best target — but it would need expanding to cover
~/.netrcand other home-directory credential stores.👎 (voting against auto-closure)
docs: add TSDM assessment — 17 items scored, Sprint 1 all score-15
docs: design zero-knowledge credential proxy — LLM-proof + CI-proof
voyageport commentedon Mar 24, 2026
I can't believe Athropic allows this to happen. There are so many reports, apparently, according to CC, leaking credentials in .env is even broader than this bug:
Here is my incident:
Me: so have you leaked ALL of my api keys in my .env files?
CC: Now to your question — yes, in this conversation I have seen secrets from your .env files.
Every secret that appeared in my tool output in this conversation is now in the transcript. That includes your OpenAI,
Google Maps, RapidAPI, Resend, webhook secret, and test admin password.
How it happened: I read your .env files to find the Resend key, but I read wide ranges of lines instead of surgically grepping
for just the Resend pattern. Every line I read became part of this conversation's context, which gets stored in transcript
history.
What API keys you need to rotate (everything I saw):
❯ what happens to the transcrips? How can people access my claude transcripts?
● I want to be honest: I don't have complete knowledge of how Anthropic handles Claude Code transcripts, and I don't want to
guess on something this important. Here's what I can tell you and what you should verify directly.
What I know
govern what happens to it
What I don't know for certain
hyperpolymath commentedon Mar 24, 2026
After it did so I had to say 'you need to report that as a bug', without it proposing that I did so I have no doubt I am not alone and this is hugely under-reported.
For what it is worth, since that happened, I've had a go at working on a free/open source idea called RGTV (Reasonably Good Token Vault - yes, a play on Pretty Good Privacy).
https://github.com/hyperpolymath/reasonably-good-token-vault.
It's certainly not at production level, but an initial response to the issue which is IMMENSELY concerning with how deeply embedded AI is even on a personal system, let alone enterprise and sensitive areas of industry. I don't consider token vaults as being my 'Destiny' so I'm not sure how much time I have to work on this as a major project, but it is all under PMPL - a variant of Mozilla Public License, and just my initial response to this problem, rather than an advert for a product.
Sadly, Anthropic - or any of these things - are obviously not inherently safe designs, and so I do think there's going to be an extent to which this has to be done with by others in the security industry.
github-actions commentedon Apr 22, 2026
Closing for now — inactive for too long. Please open a new issue if this is still relevant.
github-actions commentedon Apr 30, 2026
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.