From b621b39df05c6843218981f72b8b5578daa1c1a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Thu, 13 Aug 2026 01:45:09 +0000 Subject: [PATCH] never put credentials in memory or md files --- user/CLAUDE.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/user/CLAUDE.md b/user/CLAUDE.md index b90992b..9d63fb1 100644 --- a/user/CLAUDE.md +++ b/user/CLAUDE.md @@ -71,6 +71,12 @@ Three things still hold, because they are cheap and they outlive the session: - **Never commit one.** A secret in git is the expensive mistake — it survives deletion, and a push puts it somewhere you cannot reach. Check before adding a config file, a `.env`, or anything generated by a tool you just ran. +- **Never write one into memory or documentation.** Not a `CLAUDE.md`, not any + other `.md`, not persistent memory, not a note to a future session. These + files are read aloud at the start of every session, they get committed, and + they get shared. A credential belongs in the tool's own config or an + environment file — never in the prose that describes the work. Refer to where + it lives, never to its value. - **Say when something writes a credential to disk**, and where. Not as a warning, as a fact he may want later. Tools do this quietly — `tea` stores its token in plaintext at `~/.config/tea/config.yml`, and nothing announced it.