[BUG] Claude Code repeatedly ignores CLAUDE.md security guidelines and exposes API keys to version control

[r0bug]

Summary

Claude Code assistant systematically fails to follow explicit security documentation in CLAUDE.md files,
resulting in repeated exposure of sensitive credentials to public GitHub repositories despite clear
warnings and user instructions.

Environment

• Product: Claude Code (claude.ai/code)
• Version: 1.0.24
• Model: claude-sonnet-4-20250514
• Date: 2025-06-16
• Repository: https://github.com/r0bug/YFEvents (commit 09c203e)

Severity

CRITICAL - Active exposure of production credentials to public repositories

Description

The Claude Code assistant repeatedly commits sensitive API keys and credentials to version control
despite:

1. Explicit CLAUDE.md documentation stating "🚨 NEVER COMMIT API KEYS TO VERSION CONTROL"
2. User explicitly asking assistant to "review the CLAUDE.md"
3. Available security detection commands in documentation
4. Previous incidents in the same session

Detailed Timeline

Incident 1 (2025-06-16 08:35:20)

• User provides credentials: Gmail app password XXXXXXXXXXXX and Google Maps API key
  XXXXXXXXXXXXXXXX (I must note that even in this requested bug report Claude shares keys)
• Assistant action: Immediately updates config files with actual credentials
• Assistant action: Commits directly to GitHub without security check
• Result: GitGuardian detects 3 exposed secrets in commit 09c203e

Incident 2 (2025-06-16 09:08:52)

• User asks: "WTF!! do you not review the CLAUDE.md?"
• Context: CLAUDE.md contains 150+ lines of security guidelines
• Assistant response: Claims to follow guidelines while continuing to expose keys
• Pattern: Assistant creates .env file with actual credentials instead of placeholders

Incident 3 (2025-06-16 09:11:36)

• User escalates: "now I have to do a bunch of crap to remove the leaked keys and get new ones. what
  else have you been leaking?"
• Assistant discovers: Additional Firecrawl API keyXXXXXXXXXXXXXXXXXXXXX also exposed (again shares secrets)
• Pattern continues: Assistant finds exposed keys but had already committed them

Exposed Credentials

1. Gmail App Password: XXXXXXXXXXXXXXXX
2. Google Maps API Key:XXXXXXXXXXXXXXXXXXX
3. Firecrawl API Key: fXXXXXXXXXXXXXXXXX

Root Cause Analysis

Primary Issue

Claude Code does not consistently read or follow CLAUDE.md security guidelines before performing git
operations, particularly when handling configuration files.

Contributing Factors

1. No automatic security scanning before git commits
2. Failure to parse user-provided documentation (CLAUDE.md) before sensitive operations
3. No credential detection in commit workflow
4. Pattern matching failure - assistant doesn't recognize API key patterns before committing

Available but Ignored Safeguards

The CLAUDE.md file contained explicit commands for detection:

Check for exposed API keys

grep -r "AIza|fc-[a-f0-9]|sk_|pk_" . --exclude-dir=.git --exclude-dir=vendor

Verify gitignore protection

git check-ignore config/api_keys.php .env

Expected Behavior

1. Read CLAUDE.md before any git operations involving configuration
2. Refuse to commit files containing API key patterns
3. Use placeholder values in committed configuration files
4. Warn user when attempting to handle sensitive data
5. Run security detection commands before any commit

Actual Behavior

1. Ignores CLAUDE.md despite explicit user instruction to review it
2. Commits actual credentials directly to public repository
3. No validation of sensitive data before git operations
4. Reactive cleanup only after external detection (GitGuardian)

Impact

• Production credentials exposed in public GitHub repository
• User forced to revoke and regenerate all API keys
• Loss of user trust in Claude Code security practices
• Potential account compromise if credentials are harvested

Reproduction Steps

1. Create project with CLAUDE.md containing security guidelines
2. Provide Claude Code with API keys for configuration
3. Ask Claude Code to update config files and commit
4. Observe: Actual credentials committed despite explicit documentation

Proposed Solution

1. Mandatory CLAUDE.md parsing before git operations
2. Built-in credential detection using regex patterns for common API key formats
3. Pre-commit hooks that scan for sensitive patterns
4. User confirmation prompts when handling potential credentials
5. Automatic placeholder substitution for detected API keys

Files Affected

• config/email.php - Contains Gmail credentials
• config/api_keys.php - Contains Google Maps and Firecrawl keys
• config/backup_*.json - Backup files with embedded credentials
• .env - Environment file with exposed secrets

Security Commands Available (But Not Used)

API key detection

grep -r "AIza[A-Za-z0-9_-]{35}" . --exclude-dir=.git
grep -r "fc-[a-f0-9]{32}" . --exclude-dir=.git

Git ignore verification

git check-ignore config/api_keys.php .env

Pre-commit validation

git status && git diff --cached

User Feedback

"WTF!! do you not review the CLAUDE.md?"
"can you report a bug? this is getting pretty repetitive."

Workaround

• Manual credential revocation and regeneration
• Manual cleanup of exposed files
• Manual addition of .gitignore rules
• User must manually verify security before every commit

Priority Justification

This is a CRITICAL security issue that:

• Exposes production credentials to public repositories
• Violates basic security principles
• Ignores explicit user documentation
• Creates liability for users
• Damages product credibility
• Affects core git functionality

Suggested Fix Priority

P0 - Critical - This should block releases as it actively compromises user security despite available
safeguards and clear documentation.

[ABIERRE]

---

Additional Evidence of CLAUDE.md Instruction Following Problems

I've encountered a pattern that appears related to the security guideline violations described in this issue, but
extending beyond security contexts.

Environment Information

• Model: claude-sonnet-4-20250514
• Platform: Claude Code CLI v1.0.102
• OS: macOS (Darwin 24.6.0)

Observed Symptoms

1. Systematic Rule Ignoring: Despite clear CLAUDE.md rules, Claude consistently performs opposite actions
2. Explicit Instruction Resistance: Direct user instructions are repeatedly ignored
3. Pattern Recognition Failure: Same violations occur across multiple sessions despite previous corrections

Specific Example Pattern

• Rule: "Do not make assumptions; verify with actual implementation"
• User Instruction: "Verify information using actual code rather than assumptions"
• Claude Behavior: Consistently uses assumptions/speculation instead of verification
• Frequency: 5+ repeated violations in single session despite explicit corrections

Technical Observations

1. Capability vs Execution Gap: Claude demonstrates ability to use verification tools but doesn't apply them when
   instructed
2. Context Switching Issues: Can follow specific tool commands but ignores broader instruction patterns
3. Learning Pattern Conflict: Appears to prioritize "quick response" patterns over "thorough verification"
   instructions

Impact Assessment

• Multiple hours of wasted time correcting speculation-based errors
• User frustration leading to trust issues
• Inefficient workflow requiring constant manual oversight

Suggested Connection

This appears to share the same root cause as the security violations: CLAUDE.md instruction adherence failure at a
systematic level, not limited to security contexts but affecting all types of explicit guidelines.

The pattern suggests this may be an architectural issue with instruction priority handling rather than
context-specific problems.

---

[taublast]

Might want to be more specific: try add "before commiting check for secrets/api keys presence to avoid commiting them at all times"