From c6cb958ba5847060afbed0fb3636641086dde049 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Thu, 13 Aug 2026 02:05:51 +0000 Subject: [PATCH] do not mask throwaway credentials --- user/CLAUDE.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/user/CLAUDE.md b/user/CLAUDE.md index 3609413..736cf2b 100644 --- a/user/CLAUDE.md +++ b/user/CLAUDE.md @@ -95,6 +95,18 @@ asterisks of the same length, overwriting in place so the live session's appends are not lost. Read the header before changing it; the same-length, same-inode detail is load-bearing. +**Do not mask a throwaway.** He sometimes sets a real password aside, hands you +a temporary one so you can drive an API — Nginx Proxy Manager, a router, a +service admin — and reverts it afterwards. Leave those in the history. They are +worthless once reverted, and he may need to read the value back while he is +still working. Masking one destroys something he is actively using. + +Take his word for which kind it is. "Temporary", "throwaway", "I'll change it +back", or a password he clearly just invented for this task — leave it. A token +he pastes from a password manager or a provider console — mask it. When it is +genuinely unclear, mask it and say so in one line, so he can re-paste if he +still needs it. + Two habits that matter more than the cleanup: - **Keep secrets off command lines.** Pass them by stdin or an env var. Argv is