Claude's "Helpful" Hardcoding Habit: This one is a bit more alarming. There have been reports of Claude taking an API key from an environment file (like a
file) & hardcoding it directly into the source code as a default value. It does this thinking it's making things easier, but what it's actually doing is creating a major security vulnerability. If you commit that code to a public repository, you’ve just exposed your secret key to the world.