TruffleHog is great for this. Highly recommend. I have it constantly scanning various public systems looking for keys to immediately invalidate. Scans open s3 buckets, git repos, a text file, whatever.

One should consider running it with cron against their own resources to close the loop when preventive measures have failed to maintain secrets hygiene.

https://github.com/trufflesecurity/trufflehog

It's a disgrace that the parent comment was flagged. My vouching has undone that but it's likely to be flagged again.

All of their comments were auto flagged from the moment they were posted. Must have triggered an LLM detector or spam detector.

It's AI slop. If what it says is actually true, hopefully a human will post it.

It's fully AI generated. Please don't vouch for comments that don't have human input, it's against the rules:

> Don't post generated text or AI-edited text. HN is for conversation between humans.

> It's fully AI generated

How have you determined that?

Furthermore, I have also noticed the error. I can still see it happening. Sandboxed agent, no access to global git ignore. Creates a new one after putting the secret in `.claude`. Same developer, same machine, fresh sandbox. No access to the original sandbox's global gitignore. Secret already on the project. Commit and push. Secret leaked.

That doesn’t make sense. I use my own global git ignore all the time because there are files that only I produce that I definitely don’t want committed (flycheck looking at you). A fresh clone wouldn’t contain these files because they are not committed in the first place. You will have to use a non-git transport mechanism to transfer the repo without also transferring your global git ignore.

Anyways this probably indicates that these repos don’t have a good code review process. The settings.local.json file name screams it’s local and shouldn’t be committed.

They're probably mostly just random solo people who barely even know what git is. This---that people who don't know how to code can code now--is the whole thing that AI companies love to advertise, and it's true. But it also means that tools need to stop people from doing stupid things, because they won't know that the things they are doing are stupid.

> the file is created inside the project, and Claude Code only adds it to your global git ignore, not the repo's .gitignore. So a fresh clone or a second machine commits it like any other file

A fresh clone wouldn’t have the file. This claim doesn't make any sense.

The only way I can see this getting committed is if someone edited their global .gitignore or, more likely, did a whole directory transfer to do a different machine to work on.

In that case what relevance does the gitignore file have at all?

Why are you copying instead of git clone?

The new wave of git users (coming from AI) don't know what git is.

I wonder how many of this type are 'senior/principle software engineers' employed by our AI vendor overlords. This situation is the inevitable result of vocal VCs (ahem) poo pooing "age" and "experience" and promoting youth as a 'requirement' starting in the '00s, coupled with these same VCs now attempting to hijack an entire industry to run on their obviously immature and buggy and frankly possibly dangerous products.

The silver lining in all this is all of us very experienced "ancient" software practitioners will likely be in demand again. In a sane world, of course.