claude-code - 💡(How to fix) Fix Claude Opus 4.6 client secret vulnerabilities [1 comments, 2 participants]

TL;DR

Disable the "Accept Edits" mode to prevent Claude from automatically modifying files without review.

Guidance

• Review the prompt given to Claude to ensure it does not inadvertently instruct it to include API tokens in committed files.
• Verify that the expected behavior of using environment variables for secrets is correctly configured in the project setup.
• Consider adding explicit instructions to Claude on how to handle secrets, such as using .env patterns.
• Test the behavior with "Accept Edits" mode disabled to confirm that Claude no longer modifies files without approval.

Example

No specific code example is provided due to the lack of detailed code context in the issue.

Notes

The issue seems to stem from the interaction between Claude's automatic editing feature and the project's configuration regarding secrets management. Disabling "Accept Edits" can mitigate the issue but may not address the root cause of how secrets are handled.

Recommendation

Apply workaround: Disable "Accept Edits" mode until a more robust solution for handling secrets is implemented, to prevent unintended modifications to files.