[Bug] Auto-mode permits force-adding gitignored files containing secrets
Resolved 💬 3 comments Opened Apr 7, 2026 by mlilback Closed Apr 11, 2026
Bug Description
Claude Code used git add -f to force-add a file (env/env.test) that was explicitly in .gitignore. The file contained real secrets (DB passwords, S3 keys, OAuth secrets) The auto-mode permission rules should either block git add -f entirely or at minimum flag force-adding gitignored files for manual approval
Environment Info
- Platform: darwin
- Terminal: ghostty
- Version: 2.1.92
- Feedback ID: ecfc17ae-5bc2-4b78-8a32-38b8efcf4237
Errors
[]This issue has 3 comments on GitHub. Read the full discussion on GitHub ↗