This may not be a popular answer here, but it works as expected. Basic security hygiene means that you use password manager CLI, SSH agent, at worst temporary git-ignored env files, so that the secrets would never appear in the command line and you would never pass them to Claude. And you git-ignore any local settings by default, to prevent accidental leaks. It is not hard thing to learn, many juniors I interviewed know this. Developers who like to shoot themselves in the legs should pay the price. People who hire careless workers and do not put them in compliant environment should pay the price too.