> day 1 security best practices say you don’t write secrets to files

If only tools, including major ones, actually did that. Plenty of the biggest package managers in the world still write API keys in plain text to files. uv and npm are two of them.

and we can disable those for better alternatives. npm executes arbitrary code based on what the package said, obviously bad

claude unleashed on an organization is a whole other beast.