Sarah Reid

The “nothing new, devs always commit secrets” take misses the bit that makes this one nasty: the file isn’t a .env someone chose to commit, it’s an agent settings file that silently accumulates the exact commands you approved, secrets included, and then gets accidently committed with the project because it lives in the repo, so it ends up publically exposed. YSK that’s a different failure mode to a one-off .env leak.

If you use Claude Code (or any coding agent, tbh), the practical fix is boring but it works: rotate anything that was in that file — deleting the file from the repo doesn’t un-expose it, it’s already scraped — then check git history, because the secret is still in there unless you rewrite it. Add settings.local.json to .gitignore, run a secret scanner like gitleaks in pre-commit, and stop using ‘don’t ask again’ for commands that echo tokens or passwords. Also audit the approved-commands list now and then, and keep tokens scoped as tightly as you can so a leak like this is annoying rather than catastrophic. FYI, GitHub’s secret scanning will catch some of this after the fact, but it’s no substitute for not committing the file in the first place.

You don’t actually need Duplicati on her end at all, Duplicati can back up to a plain SFTP or WebDAV target, or S3, so her side just needs to recieve files. The simplest setup I’ve seen for a non-technical friend is SFTPGo in Docker over Tailscale, it has a web UI for managing a user and a folder, and nothing is exposed to the internet.

Keep the encryption on your side, Duplicati encrypts before upload, so she only ever sees encrypted blobs, and store the passphrase somewhere seperate from the backup itself. Set a quota if you can, agree on how much disk she is giving you, and test a restore to a spare folder once, a backup you haven’t restored is just a hope. FYI scheduled backups plus a monthly restore test is what actually saves you when a disk dies.

This is the exact trap with agents, they will use whatever privilege is lying around, they don’t stop and think ‘should I?’ like a person might. The docker group really is root, just with extra steps, so anyone in it can mount the host root fs and write to /etc.

What worked for me: run the agent as a seperate unprivileged user with no docker group at all, rootless Podman if you can, and give it a dedicated project dir only. Mounts read-only where possible, no host socket, no --privileged, and keep it off your real home dir and secrets. FYI I also log everything it runs and review the diff before anything gets applied, because the audit trail is the only way you notice it doing something sneaky after the fact. YMMV on tooling, but the principle stays the same, least privilege plus a sandbox you actually trust in your enviroment.

The June part is what stuck out to me. The device was replaced and credentials were changed, yet the attacker still knew the wallet team’s roles and came back in September through a second engineer. That definately suggests the first compromise should have been treated as exposed credentials, sessions and code access, not just a swapped laptop. YSK, for anyone in a similar job hunt, cloning a repo from an interview is the risky step here - do it in a separate throwaway machine or VM first, and don’t run anything from it untill you’ve checked who actually owns the repo. The internal AI tool angle makes logging matter too: if it can reach wallet systems, its actions need the same audit trail as a person. The October 20 and 29 dates show how long that access can sit quietly before it is used. Hope that helps.