| ▲ | doginasuit a day ago |
| That is some unsavory buck passing. Virtually anyone that didn't ask claude to create the project can leak passwords, with 1,122 known customers that have been impacted. Whether it is standard or not is irrelevant, it is part of existing functionality and entirely foreseeable. I'd expect any company worth the opportunity for trust to clearly own the mistake. |
|
| ▲ | a day ago | parent | next [-] |
| [deleted] |
|
| ▲ | thatsabadlook a day ago | parent | prev | next [-] |
| It's the anthropic way lol. "Working as designed" |
| |
| ▲ | Rapzid 17 hours ago | parent [-] | | All issues have already been fixed. No? All issues will be fixed today. No? It's early days, the models will improve and fix all issues. | | |
| ▲ | thatsabadlook 15 hours ago | parent [-] | | We are:
at the point where agi has been achieved so if you haven't bought into it you must do so. If you have bought it and have problems you aren't spending enough in it to fix them. Then finally, if you did spend enough money, you really haven't, but the problems you have are not anthropics problems even when they are. Spend more money and do free advertising for the company anyways. |
|
|
|
| ▲ | wyager a day ago | parent | prev [-] |
| Committing `.claude` is at least as dumb as committing `.keys`, so I don't think this is really in-scope |
| |
| ▲ | doginasuit a day ago | parent | next [-] | | If you know it's there. It gets created on the fly when it is needed, so unless you know that is possible and needs to be gitignored, it could easily slip by. | | |
| ▲ | thenewnewguy a day ago | parent | next [-] | | Do you not review before committing/pushing? | | |
| ▲ | DrewADesign a day ago | parent | next [-] | | Saying a professional software developer is responsible for not committing secrets is reasonable. That said, these tool chains all seem to condition developers to offload much of that diligence to the tooling itself, which makes catching mistakes harder because you’re not as used to scanning for them. Secrets files have always been foot guns, and with automation-borne complacence, and vibe coders that don’t understand the problem, I imagine these things will become even more common. | | | |
| ▲ | doginasuit a day ago | parent | prev | next [-] | | This did not impact me. But if using a tool means that secrets can randomly appear in my project, then I am using the wrong tool. | | |
| ▲ | ozozozd a day ago | parent [-] | | Correct stance. Why would you use a tool that creates tedious and dangerous work for you? “Oh you are just supposed to make up for Claude’s errors, and problem solved!” |
| |
| ▲ | SV_BubbleTime a day ago | parent | prev [-] | | Oh no, I moved all that manual tedious boring loser mentality stuff to the agent. Now Claude does it for me, and no strangely enough Claude didn’t tell me there was a problem! | | |
| ▲ | weird-eye-issue a day ago | parent [-] | | In these cases they probably just blindly committed everything themselves, if you asked Claude to review the uncommitted changes and do the commit itself it probably would have flagged this. | | |
| ▲ | fwip a day ago | parent [-] | | > Often Claude commits the file itself. In 539 of the 1,105 repos with a real secret that we traced, a commit co-authored by Claude changed the file. Those commits name every recent model, from Sonnet 4.5 to Opus 5.5. What do you make of that part of the article? | | |
| ▲ | weird-eye-issue 21 hours ago | parent [-] | | Like I said in my comment that you replied to they likely flagged it and then the user just told it to continue anyways. |
|
|
|
| |
| ▲ | post-it a day ago | parent | prev | next [-] | | It's gitignored by default. | | |
| ▲ | TheRoque a day ago | parent [-] | | The default of who or what ? Git ignore is empty "by default", inexistant even | | |
| ▲ | post-it a day ago | parent [-] | | When Claude generates the file, it also generates a .gitignore for it or fills in the existing one. | | |
| ▲ | doginasuit 19 hours ago | parent [-] | | If this is the intended behavior, a quick search of github and the article's findings seem to suggest it doesn't work. |
|
|
| |
| ▲ | SoftTalker a day ago | parent | prev [-] | | So you just routinely commit everything in the project, without looking at what it is? | | |
| |
| ▲ | sothatsit 21 hours ago | parent | prev | next [-] | | It is only the .local files within .claude that can't be committed. We have .claude committed in multiple repos to include repo-specific skills/hooks/permissions. | |
| ▲ | ozozozd a day ago | parent | prev | next [-] | | Hmm. Dumb if you don’t turn on auto-mode, dumb if auto-mode commits .claude. No way to hold it right I guess? | |
| ▲ | Hizonner a day ago | parent | prev [-] | | If you have stuff in your tree that's not part of your project's code, you're already dumb. If it's keys or secrets of any kind, you're even dumber. If it's in a hidden directory, you are even dumber still. If you rely on somebody stupid enough to do any of that not to commit it, you have gone beyond the valley of the ultra-dumb. Actually that's true even if you rely on smart people not to do it. You got your dumb card fully punched when you created `.keys` to begin with. |
|
