================================================================================
📊 Credential Guard Tracker — Daily Report
2026-10-05

Automated ecosystem tracking for credential-guard plugin (#62099)

PR Status

🟢 #62099 — Add credential-guard plugin for hardcoded secret detection
• State: OPEN
• Comments: 0
• Reviews: 1
• Reactions: 👍 0 ❤️ 0
• Created: 2026-05-24
• Updated: 2026-06-04

Repository Stats

anthropics/claude-code
• ⭐ Stars: 149,483
• 🍴 Forks: 25,579
• 👀 Watchers: 149,483
• 🐛 Open Issues: 14294
• 📝 Language: TypeScript
• 📅 Last Updated: 2026-10-05

Related Issues & Activity

Found 25 related issues across 5 keywords

Credential

🔵 #96762 — [FEATURE] Opt-in for credential/payment entry on the user's own accounts, and 1Password-style credential handoff in Claude Code
• 2 comments | 2026-09-24
🔵 #98332 — [Bug] Repeated interruptions due to credential validation accumulation in QA automation
• 0 comments | 2026-09-30
🔵 #93564 — [Bug] Safety flagging triggered during legitimate credential reuse discussion
• 0 comments | 2026-09-11

Secret

🔵 #84839 — Kaggle MCP OAuth fails at token exchange: "client_secret_basic authentication requires a client_secret"
• 0 comments | 2026-08-07
🔵 #96434 — security-guidance: keep denied and secret files out of the reviewer's reach
• 0 comments | 2026-09-23
🔵 #97299 — [BUG] headersHelper silently ignoring env vars with SECRET in the name
• 1 comments | 2026-09-25

Api_key

🔵 #94361 — [BUG] claude-in-chrome Tab Context prints full URLs of every tab, leaking credentials in query strings
• 0 comments | 2026-09-14
🔵 #89749 — [BUG] Plugin userConfig never collected on VS Code extension or Desktop app: no install prompt and no way to set it afterward
• 3 comments | 2026-08-26
🔵 #53204 — feat: add sql_injection and hardcoded_secret patterns to security-guidance
• 0 comments | 2026-04-25

Apikey

🔵 #96020 — 🐛 [Bug] Archived API key continued charging $20.86 after deletion — CSV proof attached (#29108, #53292)
• 0 comments | 2026-09-22
🔵 #94361 — [BUG] claude-in-chrome Tab Context prints full URLs of every tab, leaking credentials in query strings
• 0 comments | 2026-09-14
🔵 #89350 — [BUG] Claude Code says it is running code to test software, when it is not.
• 0 comments | 2026-08-24

Hardcoded

🔵 #93308 — [FEATURE] worktree.branchPrefix setting — worktree branch names are hardcoded to worktree-
• 2 comments | 2026-09-10
🔵 #97605 — [Bug][cyber] Safety block halts refactoring of hardcoded credentials in application source (req_011CfTo3MD4hKUu8vq4Y5tfn)
• 1 comments | 2026-09-27
🔵 #92968 — [BUG] Claude Desktop MCP OAuth callback listener uses a hardcoded port 53280
• 2 comments | 2026-09-09

🔐 Security Signals

19 signal(s) — 🟥 2 critical · 🟧 5 high · 🟨 12 medium · ⚠️ 4 stale

🟥 CRITICAL 🔵 #93232 — [Feature Request] Add secret rotation management for exposed credentials
• matched leaked secret in body | 0 comments | ⚠️ stale 25d
🟥 CRITICAL 🔵 #97605 — [Bug][cyber] Safety block halts refactoring of hardcoded credentials in application source (req_011CfTo3MD4hKUu8vq4Y5tfn)
• matched hardcoded credential in title | 1 comments
🟧 HIGH 🔵 #77084 — Feature request: cross-device secret lockbox with broker injection (agent can USE secrets, never READ them)
• matched exfiltrat in body | 3 comments | ⚠️ stale 18d
🟧 HIGH 🔵 #95598 — Expose current auth method (subscription vs API key) in status line payload
• matched api key in title | 1 comments | ⚠️ stale 16d
🟧 HIGH 🔵 #53204 — feat: add sql_injection and hardcoded_secret patterns to security-guidance
• matched api key in body | 0 comments | ⚠️ stale 163d
🟧 HIGH 🔵 #96762 — [FEATURE] Opt-in for credential/payment entry on the user's own accounts, and 1Password-style credential handoff in Claude Code
• matched api key in body | 2 comments
🟧 HIGH 🔵 #96020 — 🐛 [Bug] Archived API key continued charging $20.86 after deletion — CSV proof attached (#29108, #53292)
• matched api key in title | 0 comments
🟨 MEDIUM 🔵 #93308 — [FEATURE] worktree.branchPrefix setting — worktree branch names are hardcoded to worktree-
• matched hardcode in title | 2 comments
🟨 MEDIUM 🔵 #92968 — [BUG] Claude Desktop MCP OAuth callback listener uses a hardcoded port 53280
• matched hardcode in title | 2 comments
🟨 MEDIUM 🔵 #97299 — [BUG] headersHelper silently ignoring env vars with SECRET in the name
• matched secret in title | 1 comments
🟨 MEDIUM 🔵 #88807 — [Bug][cyber] Rotating hardcoded application secrets and configuring certificate signing (req_011CeHjrvsx8rQGQahiGpnPn)
• matched secret in title | 1 comments
🟨 MEDIUM 🔵 #98332 — [Bug] Repeated interruptions due to credential validation accumulation in QA automation
• matched credential in title | 0 comments
🟨 MEDIUM 🔵 #93564 — [Bug] Safety flagging triggered during legitimate credential reuse discussion
• matched credential in title | 0 comments
🟨 MEDIUM 🔵 #97964 — Feature request: shared secret/credential store across Claude Code, Desktop, and Web
• matched secret in title | 0 comments
🟨 MEDIUM 🔵 #96385 — [BUG] macOS OAuth credential rotation resets Keychain ACL and invalidates Always Allow
• matched credential in title | 0 comments
🟨 MEDIUM 🔵 #96434 — security-guidance: keep denied and secret files out of the reviewer's reach
• matched secret in title | 0 comments
🟨 MEDIUM 🔵 #94361 — [BUG] claude-in-chrome Tab Context prints full URLs of every tab, leaking credentials in query strings
• matched credential in title | 0 comments
🟨 MEDIUM 🔵 #91180 — [BUG] Keychain and ~/.claude/.credentials.json diverge: orphaned plaintext credential causes false-healthy diagnosis
• matched credential in title | 0 comments
🟨 MEDIUM 🔵 #91161 — [FEATURE] Third-party inference: configurable model-discovery endpoint (hardcoded /v1/models)
• matched hardcode in title | 0 comments

🎯 Key Insights

• PR Health: OPEN with 0 comments
• Repository Momentum: ⭐ 149,483 stars, 📊 149,483 watchers
• Ecosystem Activity: 25 related issues found
• Security Signals: 19 elevated signal(s) — 7 open critical/high need attention (4 stale >14d)
• Last Activity: 2026-10-05

📌 Notes

This report is auto-generated daily. Last update: 2026-10-05T16:36:40.623680Z

Links:

• PR: Add credential-guard plugin for hardcoded secret detection anthropics/claude-code#62099
• Repo: https://github.com/anthropics/claude-code
• Issues: anthropics/claude-code/issues