Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] Claude Code keeps printing out env var secrets verbatim instead of referring them as $ENV_VAR [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#56103•Fetched 2026-05-05 05:58:08
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
0
Author
xinbenlvxinbenlv
Participants
github-actions[bot]github-actions[bot]xinbenlvxinbenlv
Timeline (top)
labeled ×3commented ×1mentioned ×1subscribed ×1

Error Message

Error Messages/Logs

RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

Recently, when I use Claude Code, it repeatedly exposed env secrets from env in conversation by printing them out verbatim - which means it can be leaked to many places. I had to conduct secret rotations way too many times. Despite there were memory, skill and AGENTS.md, and settings.json deny list guardrail to prevent it from making such mistake, I've seen it does so anyway.

I consider this is a severe bug that needs to get attention. @claudeai

My environment: Claude Code v2.1.126, Opus 4.7 (1M context) with high effort · Claude Max

Until this bug is fixed, my usage of ClaudeCode subscription is effectively blocked.

What Should Happen?

The env var secrets should be referred to as $ENV_VAR rather than printing it verbatim

Error Messages/Logs

Steps to Reproduce

Try ask Claude Code to refer a secret when running a script

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

v2.1.126

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Warp

Additional Information

No response

extent analysis

TL;DR

The issue can be mitigated by ensuring that the deny list in settings.json is correctly configured to prevent Claude Code from exposing environment secrets.

Guidance

  • Review the deny list in settings.json to ensure it includes all environment variables that should be protected.
  • Verify that the AGENTS.md and memory configurations are correctly set up to prevent secret exposure.
  • Test the configuration by asking Claude Code to refer to a secret while running a script, and check if it prints the secret verbatim or refers to it as $ENV_VAR.
  • Consider reaching out to the Claude Code support team for further assistance, as the issue may be related to a bug in the current version.

Notes

The issue may be related to a bug in the current version of Claude Code, and the user is already using the latest version. The deny list configuration and AGENTS.md settings may need to be adjusted to prevent secret exposure.

Recommendation

Apply workaround: The user should review and adjust their deny list configuration and AGENTS.md settings to prevent secret exposure until a fixed version of Claude Code is available.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#dependency conflict#environment setup#docker error#permission error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix [BUG] Claude Code keeps printing out env var secrets verbatim instead of referring them as $ENV_VAR [1 comments, 2 participants]