[BUG] Unapproved database credentials appearing in approved commands list

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Description:

I discovered that Claude Code was using database credentials that appeared in my approved commands list, but which I never explicitly approved. Specifically:

Credentials that appeared:

• Host: aws-0-us-west-1.pooler.supabase.com
• Port: 6543
• User: postgres.xzgvyfpcqnqbfgmkftuk
• Password: enf4***wkA1Ii0QK

What's concerning:

1. I do have the password PGPASSWORD=enf4***wkA1Ii0QK in my approved settings and my code
2. However, I have NEVER used the Supabase host aws-0-us-west-1.pooler.supabase.com
3. I have NEVER used the user postgres.xzgvyfpcqnqbfgmkftuk
4. Claude Code used these credentials without my explicitly approving the full connection string

My actual database:

• Host: localhost
• Port: 5432
• User: ai-chatbot
• Database: ai_chatbot
• Password: 7c54***99d (different from the one above)

What happened:
Claude Code attempted to apply a database migration using the unapproved Supabase credentials. When I questioned this, Claude explained that these credentials appeared in
My approved commands list. However, I confirmed via grep that the Supabase host and user do not exist anywhere in my project files.

Potential issues:

• Data leakage between sessions or users
• Incorrect credential composition from partial approvals
• Session contamination with credentials from another context

Environment:

• Claude Code CLI
• Project: /Users/sam/projects/rag-chatbot
• Platform: macOS (Darwin 24.6.0)
• Date: 2025-10-30

What Should Happen?

Claude Code should only use credentials that I have explicitly approved in their complete form, not composite credentials assembled from partial matches.

Error Messages/Logs

Steps to Reproduce

I am unable to reliably reproduce this issue, as I don't understand how these credentials appeared in my approved commands.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Code v2.0.29 with Sonnet 4.5

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_