Claude Code logs partial keystrokes/plaintext email address in

Comments (1)

phrinj · 10h ago

I discovered that Claude Code's ~/.claude.json file logs partial/unsent keystrokes and stores OAuth metadata (emails, user IDs) in plaintext. The metadata isn't even needed after initial auth - you can delete it and stay logged in.

This creates an unencrypted, ever-growing log of sensitive user activity. Filed an issue and wrote a cleanup script that deletes this info instantly when it tries to save it.

Verified on WSL, but likely affects all platforms.

I made my VM think it has a CPU fan (wbenny.github.io)

Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok (github.com)

Using the Internet without IPv4 connectivity (jamesmcm.github.io)

The Medley Interlisp Project: Reviving a Historical Software System [pdf] (interlisp.org)

Bloom Filters by Example (llimllib.github.io)

The Unsustainability of Moore's Law (bzolang.blog)

The Consciousness Gradient: When Machines Begin to Wonder (v1tali.com)

More on Apple's Trust-Eroding 'F1 the Movie' Wallet Ad (daringfireball.net)

Scientists Retrace 30k-Year-Old Sea Voyage, in a Hollowed-Out Log (nytimes.com)

MCP: An (Accidentally) Universal Plugin System (worksonmymachine.substack.com)

Implementing fast TCP fingerprinting with eBPF (halb.it)

Performance Debugging with LLVM-mca: Simulating the CPU (johnnysswlab.com)

Sequence and first differences together list all positive numbers exactly once (oeis.org)

Solving `Passport Application` with Haskell (jameshaydon.github.io)

Show HN: SmartStepper – Multi-Step Form Library with Config-Based Flow (github.com)

The Death of the Middle-Class Musician (thewalrus.ca)

Brad Woods Digital Garden (garden.bradwoods.io)

What LLMs Know About Their Users (schneier.com)

Show HN: A different kind of AI Video generation

Improving River Simulation (undiscoveredworlds.blogspot.com)

Schizophrenia is the price we pay for minds poised near the edge of a cliff (psychiatrymargins.com)

Engineered Addictions (masonyarbrough.substack.com)

We ran a Unix-like OS on our home-built CPU with a home-built C compiler (2020) (fuel.edby.coffee)

BusyBeaver(6) Is Quite Large (scottaaronson.blog)

JavaScript Trademark Update (deno.com)

What UI first distinguished radio buttons from checkboxes with circles/squares? (retrocomputing.stackexchange.com)

Magnetic Tape Storage Technology: usage, history, and future outlook (dl.acm.org)

Life of an inference request (vLLM V1): How LLMs are served efficiently at scale (ubicloud.com)

2025 ARRL Field Day (arrl.org)

An Indoor Beehive in My Bedroom Wall (keepingbackyardbees.com)

Is being bilingual good for your brain? (economist.com)

Community Is Motivation on Tap (alanwu.xyz)

Sirius: A GPU-native SQL engine (github.com)

The European wood pigeon helped me appreciate its omnipresent city cousins (nytimes.com)

Abusing copyright strings to trick SW into thinking it's running competitor's PC (devblogs.microsoft.com)

Finding Peter Putnam (nautil.us)

The AI Backlash Keeps Growing Stronger (wired.com)

Show HN: AGL a toy language that compiles to Go (github.com)

Parsing JSON in Forty Lines of Awk (akr.am)

An Important New Study on Phones and Kids (calnewport.com)

Bazzite would shut down if Fedora goes ahead with removing 32-bit (gamingonlinux.com)

Blackwell: Nvidia's GPU (chipsandcheese.com)

Tennis Scorigami (tennis-scorigami.com)

It's Bulletproof, Fire-Resistant and Stronger Than Steel. It's Superwood (wsj.com)

How Field Notes went from side project to cult notebook (fastcompany.com)

Gradient Descent Visualiser (uclaacm.github.io)

Show HN: Vet – A tool for safely running remote shell scripts (getvet.sh)

Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development [pdf] (media.defense.gov)

Lago (Open-Source Usage Based Billing) is hiring for ten roles (ycombinator.com)

Universal pre-training by iterated random computation (arxiv.org)

Claude Code logs partial keystrokes/plaintext email address in –/.claude.json

Comments (1)