claude-code - 💡(How to fix) Fix [Bug] GitHub auth defaults to token over SSH, leaking secrets in chat and /feedback transcript

Bug Description

Title: GitHub auth defaults to tokens not SSH (led to secret pasted in chat), and /feedback leaks session history containing that secret

1. Token-first auth default When setting up CLI GitHub auth, Claude defaulted to gh + Personal Access Token instead of SSH. The gh interactive login can't run in Claude Code's ! prompt, the token then hit a read:org scope error, and getting unblocked ended with a live token pasted into the chat — a real secret exposure. SSH was available the whole time and exposes only a public key.

The root issue is Claude's default judgment, not the menus: it leads with the token route over the safer SSH one. When challenged, Claude offered to save a "local preference" — which just reframes Claude's bad default as the user's missing config and doesn't fix the default for anyone else.

Fix: Default to SSH-first for CLI git auth (shares only a public key). Tokens as a fallback only, and if a token must be used, instruct the user to run it in their own terminal — never engineer a flow that results in a secret being pasted into the chat transcript.

1. /feedback re-transmits secrets via session history Filing this very report through /feedback is unsafe, because /feedback attaches the full session transcript — which here contains the pasted token. So the feedback mechanism itself becomes a leak vector for any secret the session has handled. A user trying to report a credential-exposure bug is forced to re-transmit the credential to do so.

Fix: Before sending, /feedback should scan the attached transcript for likely secrets (e.g. ghp_, gho_, API-key patterns, private keys) and either redact them or warn the user and let them strip the transcript. At minimum, offer a "send report text only, without session history" option.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.156
• Feedback ID: 4913dbb9-4e2d-4c98-866d-9e69b6666b8a

Errors

[]