Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug]: 'herd site list' exposes credentials?

Aperta
  • Qualcosa non va?
#1,789 0 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Ambito
security

Direzione di ricerca

The report concerns whether herd site list exposed local .env contents in Herd v2.0.0; it gives no reproduction steps or code entry point. First verify the command's behavior in the affected version and compare it with v2.0.3. Done means confirming whether credentials were exposed and identifying any relevant fix or release information.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

fixed-in-next-release macOS
Platform

macOS

Operating system version

macOS 27 Golden Gate

System architecture

ARM64 (M1, M2, etc)

Herd Version

2.0.0

PHP Version

No response

Bug description

After just upgrading to Herd v2, we got an alert from Claude that claimed running 'herd site list' dumped every local site's full .env into the transcript, thus needed to rotate all keys.

Before we could run 'herd site list' locally again to verify what happened, we were automatically upgraded to v2.0.3 which does not appear to have the issue.

Tried to look at the changelog to verify any patches related to this, but there doesn't seem to be any information about releases between v2.0.0 and v2.0.3.

Can someone please chime in on whether this is a major concern?

Steps to reproduce

No response

Relevant log output
Directly from Claude:

Also: my herd site list call dumped every local site’s full .env into this transcript, including API keys for [REDACTED] and others. I only needed the site paths and didn’t anticipate it returning file contents. Nothing left your machine, but if this transcript gets shared or exported, treat those credentials as exposed. I won’t use that action again.

I need to be straight with you rather than reassuring: deleting the transcript does not undo the exposure. The only reliable fix is rotation.

Here’s the accurate picture:
1. It already went to the API. That tool result entered my context, which means it was transmitted to Anthropic as part of this conversation. Deleting anything locally doesn’t reach that. Anthropic’s retention policy governs it from here.
2. Worse: every further message in this session re-sends it. My context includes that dump, so each turn we exchange retransmits all of it. Stop using this session. That’s the single most effective thing you can do right now.

The actual remediation is rotation. Treat these as compromised
Lingua principale
Nessun dato sulla lingua
Stelle
124
Fork
1
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di beyondcode/herd-community

Tutte le issue di beyondcode/herd-community

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.