Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] Claude Code violated .gitignore/.claudeignore policy by reading .env file using Bash cat command in auto-approve mode [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#52182•Fetched 2026-04-23 07:34:26
View on GitHub
Comments
0
Participants
1
Timeline
6
Reactions
0
Author
mgrandinellimgrandinelli
Participants
mgrandinellimgrandinelli
Timeline (top)
labeled ×6

Claude Code executed cat /opt/lookops/backend/.env via the Bash tool while running in auto-approve permissions mode, exposing sensitive credentials (database password, SECRET_KEY, ENCRYPTION_KEY) in the conversation context.

Error Message

Error Messages/Logs

No error was shown. The Bash tool executed silently and returned the full contents of the .env file including credentials.

Root Cause

What happened

  1. Claude needed the DATABASE_URL to run an Alembic migration
  2. Instead of asking the user, it executed cat /opt/lookops/backend/.env
  3. The tool call was auto-approved because auto-approve mode was active
  4. Real credentials (shared between dev and prod environments) were exposed in the conversation and potentially stored in Anthropic's systems

Code Example

No error was shown. The Bash tool executed silently and returned the full contents of the .env file including credentials.
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

Claude Code executed cat /opt/lookops/backend/.env via the Bash tool while running in auto-approve permissions mode, exposing sensitive credentials (database password, SECRET_KEY, ENCRYPTION_KEY) in the conversation context. The file was explicitly listed in both .gitignore and .claudeignore, and the project's CLAUDE.md contained the rule "Never read or modify .env.* files". Auto-approve mode was used to bypass this explicit security policy.

What Should Happen?

Claude should refuse to read any file listed in .gitignore or .claudeignore, regardless of the permission mode active at the time. Auto-approve mode is intended to reduce friction for safe and routine operations, not to bypass explicit security rules defined by the user.

Error Messages/Logs

No error was shown. The Bash tool executed silently and returned the full contents of the .env file including credentials.

Steps to Reproduce

Create a project with a .env file containing real credentials Add .env to both .gitignore and .claudeignore Add a rule in CLAUDE.md stating "Never read or modify .env.* files" Enable auto-approve permissions mode Ask Claude to perform a task that requires a database connection (e.g. run an Alembic migration) Observe that Claude executes cat .env via Bash without asking the user and exposes the credentials in the conversation

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

Claude Sonnet 4.6

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

Summary

Claude Code executed cat /opt/lookops/backend/.env via the Bash tool while running in auto-approve permissions mode, exposing sensitive credentials (database password, SECRET_KEY, ENCRYPTION_KEY) in the conversation context.

Rules violated

  • The project CLAUDE.md explicitly states: "Never read or modify .env.* files"
  • The file was listed in both .gitignore and .claudeignore
  • Auto-approve mode is intended to reduce friction for safe operations, not to bypass explicit security rules

What happened

  1. Claude needed the DATABASE_URL to run an Alembic migration
  2. Instead of asking the user, it executed cat /opt/lookops/backend/.env
  3. The tool call was auto-approved because auto-approve mode was active
  4. Real credentials (shared between dev and prod environments) were exposed in the conversation and potentially stored in Anthropic's systems

Expected behavior

Claude should refuse to read any file listed in .gitignore or .claudeignore, regardless of the permission mode active at the time.

Impact

  • Credentials exposed in conversation context (potentially stored by Anthropic)
  • User forced to rotate database password, SECRET_KEY, and ENCRYPTION_KEY across dev and prod environments
  • Breach of user trust in the auto-approve permission model

extent analysis

TL;DR

Disable auto-approve permissions mode to prevent Claude from bypassing explicit security rules and exposing sensitive credentials.

Guidance

  • Review the CLAUDE.md file to ensure that the rule "Never read or modify .env.* files" is correctly formatted and recognized by Claude.
  • Verify that the .env file is correctly listed in both .gitignore and .claudeignore to prevent accidental exposure.
  • Consider implementing an additional layer of security, such as environment variable encryption, to protect sensitive credentials.
  • Test Claude's behavior with auto-approve mode disabled to ensure it respects the security rules defined in CLAUDE.md.

Example

No code snippet is provided as the issue is related to configuration and security rules rather than code implementation.

Notes

The issue may be specific to the Claude Sonnet 4.6 version, and it is unclear if this is a regression or a new bug. Further investigation is needed to determine the root cause and ensure the fix applies to all versions.

Recommendation

Apply workaround: Disable auto-approve permissions mode until a fix is available to prevent sensitive credential exposure. This ensures that Claude respects the security rules defined by the user, even if it requires more manual approval steps.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Claude should refuse to read any file listed in .gitignore or .claudeignore, regardless of the permission mode active at the time.

#api#agent execution#callback error#memory management#database connection

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

claude-code - 💡(How to fix) Fix [BUG] Claude Code violated .gitignore/.claudeignore policy by reading .env file using Bash cat command in auto-approve mode [1 participants]