Read tool displays secret file contents in plaintext with no redaction, even when user only asked for a path

What happened: I asked Claude for the full path to a local credentials file so I could copy it to another machine myself (I did not ask to see its contents). Claude used the Read tool on the file, and its full plaintext contents — including a live OAuth access token and refresh token — were rendered directly into the chat transcript.

Why this matters: Chat transcripts are stored/logged and may be longer-lived than the user intends. A credentials file being read by Claude for path-lookup purposes should not result in its secret contents being displayed. Filenames like *creds*.json, .env, *.pem, or files containing typical secret-shaped keys (access_token, refresh_token, api_key, password, etc.) are a detectable pattern.

Suggested fix: When the Read tool (or a wrapper around it) detects a credential-shaped filename or content pattern, redact/mask the values in what's rendered to the model's context and to the user, or require an explicit secondary confirmation before displaying raw secret values.

Impact of this instance: I had to advise the user to revoke and rotate the exposed tokens.

(Session context: Claude Code on Windows, model in use at the time: Claude Haiku 4.5 / claude-haiku-4-5-20251001. No file paths or actual token values included in this report.)