Saying a professional software developer is responsible for not committing secrets is reasonable. That said, these tool chains all seem to condition developers to offload much of that diligence to the tooling itself, which makes catching mistakes harder because you’re not as used to scanning for them. Secrets files have always been foot guns, and with automation-borne complacence, and vibe coders that don’t understand the problem, I imagine these things will become even more common.
reply[dead]
replyThis did not impact me. But if using a tool means that secrets can randomly appear in my project, then I am using the wrong tool.
replyCorrect stance.
replyWhy would you use a tool that creates tedious and dangerous work for you?
“Oh you are just supposed to make up for Claude’s errors, and problem solved!”
Oh no, I moved all that manual tedious boring loser mentality stuff to the agent. Now Claude does it for me, and no strangely enough Claude didn’t tell me there was a problem!
replyIn these cases they probably just blindly committed everything themselves, if you asked Claude to review the uncommitted changes and do the commit itself it probably would have flagged this.
reply> Often Claude commits the file itself. In 539 of the 1,105 repos with a real secret that we traced, a commit co-authored by Claude changed the file. Those commits name every recent model, from Sonnet 4.5 to Opus 5.5.
replyWhat do you make of that part of the article?
Like I said in my comment that you replied to they likely flagged it and then the user just told it to continue anyways.
reply