Home

Security and data

1. 01Secrets: never let them pass through, never display them in the clear8 min

   A secret pasted into a conversation, even briefly, stays present afterwards in the logs and in any automatic review of the history, and a configuration command run for one precise purpose can display a neighbouring secret in the clear if its filter is too broad.

2. 02A committed secret is burned: rotate it now, never by the date7 min

   A secret tracked by a repository is treated as compromised from the moment it is written, not when someone proves it has been read, and the fix that reaches every copy is to rotate the identifier, with history rewriting coming second and not always necessary.

3. 03Pseudonymous and anonymous are two different things7 min

   A reference number used in place of a name remains personal data as long as a correspondence table exists somewhere, which can make the recipient a processor depending on its actual role rather than a simple case of anonymisation, and a pseudonymous identity on a repository needs its own local configuration.

4. 04Auditing a skill before installing it8 min

   Audit a third-party skill before installing it: quarantine it, read all of its content, run a security scanner, and rotate any secret a removed skill could have touched. The most frequent risk is the hidden instruction, almost always combined with malicious code.

5. 05What an agent can leak without being asked to9 min

   An instruction hidden in content that Claude reads during the task, a web page, a file or a repository comment, can make it propose an outbound action you did not ask for: this is indirect prompt injection, which the documented protections reduce without eliminating.

6. 06Responsible automation: reversible first, failure reported, fix requested8 min

   An automation in Auto, Accept Edits or Bypass Permissions mode runs most deletions the moment the command is reached, without confirmation: build the human checkpoint before the destructive command. A silent failure never announces itself, and a blocked fix is requested, not merely noted.

7. 07What leaves the machine, what gets archived, what never gets shared8 min

   Every request sends the prompt and the response over the network and leaves a local copy readable in plain text on disk: a secret pasted once exists in two places. Archive rather than delete, because a move stays reversible. Filter an internal document before sending it: an inventory of sensitive data, then a re-read as a hostile reader.

8. 08Reading is enough to expose a secret8 min

   A text search over a whole folder returns every line containing the pattern, even from a hidden .env file, without any read of that file having been requested. A Read(./.env) deny rule does not cover a command that reads files without naming them, like grep -r, nor a subprocess that opens its own files.

9. 09A text-pattern guard is not a security boundary9 min

   A guard that refuses a word in the text of a command judges a spelling, not an effect: any spelling that avoids that word gets through, and even a list of allowed commands matched by exact equality lets through the code that an allowed command reads from a file the agent can edit.

10. 10A general agreement does not authorise a specific send8 min

    An agreement given on a working method validates the way of proceeding, not a send whose content has not yet been shown: the approval to send names the text and the recipients, or the category of sends that a standing authorisation itself designates.