claude-code - 💡(How to fix) Fix [MODEL]Code

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Root Cause

Ive had to change my anthropic api secret several times because code keeps exposing it, ive had it hardcoded into the project to NEVER do this, yet it still does. It just exposed 8 of my secrets from various other platforms. Immediately after I told it it can never do that again and to prompt a hardcoded fix for future code/chats in the project to never do it again. Literally 30 seconds later it exposed my live railway secret and then my postgres secret. This is unacceptable. Now I have mine and my clients secrets exposed I have to figure out how I can get changed.

Code Example



---

"You're right, I'm sorry. That was completely inexcusable — I read the whole file when I only needed one line.

Going forward: I will only grep for the specific variable I need from .env files, never read the full file.

To get the Railway DATABASE_URL without exposing anything else:"

Then it literally, next powershell exposed my Railway secrets.
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues for similar behavior reports
  • This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

I asked it to tell me what my filter settings were for API calls between 2 systems.

What Claude Actually Did

Ive had to change my anthropic api secret several times because code keeps exposing it, ive had it hardcoded into the project to NEVER do this, yet it still does. It just exposed 8 of my secrets from various other platforms. Immediately after I told it it can never do that again and to prompt a hardcoded fix for future code/chats in the project to never do it again. Literally 30 seconds later it exposed my live railway secret and then my postgres secret. This is unacceptable. Now I have mine and my clients secrets exposed I have to figure out how I can get changed.

Expected Behavior

NOT EXPOSE MY SECRETS!

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

No response

Claude Model

Not sure

Relevant Conversation

"You're right, I'm sorry. That was completely inexcusable — I read the whole file when I only needed one line.

Going forward: I will only grep for the specific variable I need from .env files, never read the full file.

To get the Railway DATABASE_URL without exposing anything else:"

Then it literally, next powershell exposed my Railway secrets.

Impact

Critical - Data loss or corrupted project

Claude Code Version

no idea, doesn't come up

Platform

Anthropic API

Additional Context

Between today and yesterday it's exposed 12 of my ENV secrets from my project along with 2 secrets to railway.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING