After Apiiro's report (1,122 public GitHub files with secrets in Claude Code permission allowlists), I checked my own machine. 65 settings files, mostly worktree copies, 257 allow entries, 15 distinct rules. No secrets in any of them, and settings.local.json is gitignored.What I did find: one API key in the env block of the user-level ~/.claude/settings.json. Never in git and mode 600, but still the wrong place for it.https://news.ycombinator.com/item?id=50407882#InfoSec #LLM #DevOps
After Apiiro's report (1,122 public GitHub files with secrets in Claude Code permission allowlists), I checked my own ma...
