Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Security: Bash tool should not clone repos to /tmp (world-readable) [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#48382•Fetched 2026-04-16 07:01:46
View on GitHub
Comments
0
Participants
1
Timeline
5
Reactions
0
Author
stian-fjordlinestian-fjordline
Participants
stian-fjordlinestian-fjordline
Timeline (top)
labeled ×4closed ×1

When Claude Code needs to work in a secondary repo, it may git clone it to /tmp. This creates a security issue because /tmp is world-readable on macOS/Linux, meaning any process or user on the machine can read the cloned repo contents — which may include secrets in configmaps, credentials, internal URLs, etc.

Root Cause

When Claude Code needs to work in a secondary repo, it may git clone it to /tmp. This creates a security issue because /tmp is world-readable on macOS/Linux, meaning any process or user on the machine can read the cloned repo contents — which may include secrets in configmaps, credentials, internal URLs, etc.

RAW_BUFFERClick to expand / collapse

Description

When Claude Code needs to work in a secondary repo, it may git clone it to /tmp. This creates a security issue because /tmp is world-readable on macOS/Linux, meaning any process or user on the machine can read the cloned repo contents — which may include secrets in configmaps, credentials, internal URLs, etc.

Steps to reproduce

  1. Ask Claude Code to make a change in a different repo than the current working directory
  2. Claude Code clones the repo to /tmp/<repo-name>
  3. The repo contents (potentially including sensitive config) are now world-readable

Additional issue

SSH commit signing does not work in /tmp clones (the git commit command hangs indefinitely), while it works fine in the user's normal checkout directories. This means Claude Code pushes unsigned commits from /tmp, which may violate branch protection rules.

Expected behavior

  • Claude Code should never clone repos to /tmp
  • If a local checkout of the repo already exists, it should use that instead
  • If cloning is necessary, it should use a directory with restricted permissions

Environment

  • macOS (Darwin 25.4.0)
  • Claude Code CLI
  • Git with commit.gpgsign=true and gpg.format=ssh

extent analysis

TL;DR

Change Claude Code to clone repositories to a directory with restricted permissions instead of /tmp to prevent security issues and fix SSH commit signing.

Guidance

  • Identify a secure directory for cloning repositories, such as a user-specific directory with restricted permissions.
  • Configure Claude Code to use this secure directory for cloning instead of /tmp.
  • Verify that the cloned repository contents are not world-readable by checking the directory permissions.
  • Test SSH commit signing in the new clone directory to ensure it works as expected.

Example

No code snippet is provided as the issue does not imply a specific code change, but rather a configuration or setup change.

Notes

The solution may require changes to Claude Code's configuration or implementation, and may involve platform-specific considerations for setting up secure directories.

Recommendation

Apply workaround: Configure Claude Code to clone repositories to a secure directory with restricted permissions, as this addresses both the security issue and the SSH commit signing problem.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

  • Claude Code should never clone repos to /tmp
  • If a local checkout of the repo already exists, it should use that instead
  • If cloning is necessary, it should use a directory with restricted permissions
#conversation history#tool integration#LLM response#prompt template#agent execution

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING