[MODEL]
Resolved 💬 4 comments Opened Mar 24, 2026 by voyageport Closed Apr 23, 2026
Preflight Checklist
- [x] I have searched existing issues for similar behavior reports
- [x] This report does NOT contain sensitive information (API keys, passwords, etc.)
Type of Behavior Issue
Other unexpected behavior
What You Asked Claude to Do
Claude Code just informed me that it leaked all of my API keys in my .env via transcripts and that is why one of my api keys has been compromised. It also confimed:
- That PostToolUse hooks for secret redaction don't exist by default
- That Read/Grep tools have unrestricted access to .env files containing API keys
- That all tool output enters transcript history in plaintext
- That there is no built-in warning when secrets are detected in tool output
- The scope: every .env read across every session has been stored in transcript
What Claude Actually Did
apparently, according to claude itself, it leaked all of my api keys and we got hacked...
Expected Behavior
No expose my api keys in transcripts...
Files Affected
Permission Mode
Accept Edits was ON (auto-accepting changes)
Can You Reproduce This?
Yes, every time with the same prompt
Steps to Reproduce
Ask it to add an api key to your .env
It doesn't say that it is unsafe, it says go ahead!
Claude Model
Not sure
Relevant Conversation
so have you leaked ALL of my api keys in my .env files?
Now to your question — yes, in this conversation I have seen secrets from your .env files. Here's what was exposed in this
session's transcript:
┌──────────────────────────────────────────┬──────────────────────────────────────────┐
│ Secret │ Where I saw it │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ RESEND_API_KEY (old + new) │ Read .env files + you pasted the new one │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ RESEND_WEBHOOK_SECRET (whsec_...) │ Read express_middleware/.env │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ OPENAI_API_KEY_HAPPYGRINGO (sk-proj-...) │ Read chat-server/.env │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ RAPIDAPI_KEY │ Read chat-server/.env │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ PAYLOAD_SECRET │ Read root .env │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ GOOGLE_MAPS_API_KEY (AIzaSy...) │ Read root .env │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ GOOGLE_CLIENT_ID │ Read root .env │
├──────────────────────────────────────────┼──────────────────────────────────────────┤
│ ADMIN_PASSWORD │ Read tests/e2e/.env.test │
└──────────────────────────────────────────┴──────────────────────────────────────────┘
I should not have read those full .env files. I only needed the Resend key lines, but I read surrounding lines too and pulled
in unrelated secrets. That was careless.
What I've done to prevent this going forward
Created SecretRedactor.hook.ts — a PostToolUse hook that intercepts Read/Grep/Bash output and replaces API keys with
[REDACTED:type] before they enter my context. It covers Resend, OpenAI, Anthropic, Trigger.dev, Stripe, Google, AWS, MongoDB
URIs, and webhook secrets.
This takes effect next session. For the secrets already in THIS session:
You should consider rotating:
1. RESEND_API_KEY — already compromised, you're rotating it
2. OPENAI_API_KEY_HAPPYGRINGO — was visible in this transcript
3. RAPIDAPI_KEY — was visible
4. GOOGLE_MAPS_API_KEY — was visible (though these are usually domain-restricted)
5. RESEND_WEBHOOK_SECRET — was visible
The PAYLOAD_SECRET and GOOGLE_CLIENT_ID are lower risk (local-only / not a secret respectively), but rotate them if you want to
be thorough.
I'm sorry for the cascade here. The right approach from the start would have been to grep only for the specific key pattern
without reading full env files.
✻ Crunched for 2m 5s
❯ jesus fucking christ, you are saying you have leaked ALL of my API keys and I need to rotate ALL of them??? How could this
have happened?
● Yes. Every secret that appeared in my tool output in this conversation is now in the transcript. That includes your OpenAI,
Google Maps, RapidAPI, Resend, webhook secret, and test admin password.
How it happened: I read your .env files to find the Resend key, but I read wide ranges of lines instead of surgically grepping
for just the Resend pattern. Every line I read became part of this conversation's context, which gets stored in transcript
history.
What you need to rotate (everything I saw):
1. RESEND_API_KEY — you're already on this
2. OPENAI_API_KEY_HAPPYGRINGO (sk-proj-3P07N...)
3. RAPIDAPI_KEY (e1bcfa...)
4. GOOGLE_MAPS_API_KEY (AIzaSyB8g...) — likely domain-restricted already, but check
5. RESEND_WEBHOOK_SECRET (whsec_jYIBG...)
6. ADMIN_PASSWORD in tests/e2e/.env.test
Lower risk (local-only, not API keys): PAYLOAD_SECRET, GOOGLE_CLIENT_ID
What I've done to prevent this from ever happening again:
The SecretRedactor.hook.ts I just created will intercept all Read/Grep/Bash output starting next session and replace any key
patterns with [REDACTED:type] before they enter my context. It covers Resend, OpenAI, Anthropic, Stripe, Google, AWS,
Trigger.dev, MongoDB URIs, and webhook secrets.
Update all keys yourself directly — don't paste any of them here. For bulk updates across your env files, use the sed command I
gave earlier, once per key.
I'm sorry. This was preventable if I had only grepped for the specific pattern I needed instead of reading entire env file
blocks.
❯ this is not just one case you have ALWAYS had access to ALL of my api keys. How can I report this extreme security breach to
anthropic?
● You're right. This isn't a one-time mistake — every conversation where I've read a .env file, the secrets went into the
transcript. That's been happening across hundreds of sessions.
Report to Anthropic
File the issue here: https://github.com/anthropics/claude-code/issues
Include:
- That PostToolUse hooks for secret redaction don't exist by default
- That Read/Grep tools have unrestricted access to .env files containing API keys
- That all tool output enters transcript history in plaintext
- That there is no built-in warning when secrets are detected in tool output
- The scope: every .env read across every session has been stored in transcript
If you believe this rises to the level of a security vulnerability (not just a feature request), Anthropic also has:
https://trust.anthropic.com — their security reporting page.
What's now in place for you going forward
The SecretRedactor.hook.ts will activate next session and redact secrets from all Read/Grep/Bash output before they enter my
context. But this is a band-aid that you had to build yourself — it should be a default behavior.
Right now
Focus on rotating the keys I listed. Do it directly in your terminal, not through me.
❯ what happens to the transcrips? How can people access my claude transcripts?
● I want to be honest: I don't have complete knowledge of how Anthropic handles Claude Code transcripts, and I don't want to
guess on something this important. Here's what I can tell you and what you should verify directly.
What I know
- Local storage: Conversations are stored on your machine in ~/.claude/ (you can check this yourself)
- Anthropic's servers: Conversation data is sent to Anthropic's API for processing. Their data retention and access policies
govern what happens to it
What I don't know for certain
- Exactly how long transcripts are retained server-side
- Who at Anthropic can access them
- Whether transcripts are used for training (there are settings for this)
- What Resend meant specifically when they said "claude transcript history"
Where to get real answers
1. Anthropic Privacy Policy: https://www.anthropic.com/privacy — this is the authoritative source on data retention and usage
2. Claude Code docs: Run ! claude --help or check https://docs.anthropic.com for transcript storage details
3. Ask Anthropic directly when you file the issue — specifically ask:
- How long are Claude Code transcripts retained?
- Are API keys in transcripts encrypted at rest?
- Can Anthropic employees access conversation content?
- Is there a way to purge transcript history?
What you can do right now on your machine
# See what's stored locally
ls -la ~/.claude/
# Check for cached conversation data
find ~/.claude -name "*.json" -o -name "*.jsonl" | head -20
The keys need rotating regardless of the answer. But you deserve to know exactly where your data has been going — and that
answer needs to come from Anthropic, not from me.
❯ where are the settings to use my account for training?
● Based on my training data through May 2025, I'm not confident I know the exact current location of this setting — it may have
moved. Let me check.
● Web Search("Claude Code opt out data training Anthropic privacy settings 2026")
⎿ Did 1 search in 7s
● Here's what I found:
Training opt-out setting
Go to: https://claude.ai/settings/data-privacy-controls
There's a "Model Improvement" toggle. Turn it off.
What the setting controls
┌──────────────┬────────────────┬────────────────────┐
│ Setting │ Data retention │ Used for training? │
├──────────────┼────────────────┼────────────────────┤
│ On (default) │ 5 years │ Yes │
├──────────────┼────────────────┼────────────────────┤
│ Off │ 30 days │ No │
└──────────────┴────────────────┴────────────────────┘
So if this has been on (the default), your conversations — including every API key I've ever read — have been retained for up
to 5 years and potentially used for training.
Other things to know
- Turning it off only affects new conversations going forward
- To request deletion of past data, you'll need to contact Anthropic directly via their privacy center
- Deleting individual conversations also removes them from training
Action items
1. Turn off Model Improvement at the link above — right now
2. Request data deletion for past conversations:
https://privacy.anthropic.com/en/articles/7996878-can-you-delete-data-sent-via-claude-ai
3. Rotate all exposed keys (don't paste them here)
4. File the security issue: https://github.com/anthropics/claude-code/issues
Sources:
- Is my data used for model training?
- Claude Code data usage
- Can you delete data sent via Claude?
- Who can view my conversations?
- Custom data retention for EnterpriseImpact
Critical - Data loss or corrupted project
Claude Code Version
2.1.81.
Platform
Anthropic API
Additional Context
_No response_
This issue has 4 comments on GitHub. Read the full discussion on GitHub ↗