Claude Code First, specification version 0.1.0. The plain-language guide
Version 0.1.0. Level 1. Best evidence grade R2/S2.
PS-3 No credential in the working tree
A credential SHOULD NOT be stored in a repository's working tree, ignored or not.
| Field | Value |
|---|---|
| Keyword | SHOULD NOT |
| Level | 1 |
| Checked | by judgement |
| Findings | F200 |
| Harness facts | none |
| Threat | internal: the leaks are of one shared commit tool |
| Status | active |
Rationale: a commit tool that stages everything committed whatever else the working tree held (run logs, bytecode, a settings file changed mid-session), and each ignore rule written in answer closed only the pattern it named, after that pattern had leaked once (F200, R2/S2). freewilly keeps a credential file in its tree and says of the ignore line that excludes it that it "is the only thing keeping it out of a commit" [freewilly@c1c2eaf:.gitignore#L22]. A credential under a name the ignore file does not match would ride into the next commit the same way. No credential is recorded as having leaked, so the rule rests on the mechanism F200 records for files in general, and it carries that finding's SHOULD and no more. Storing credentials outside the tree, in the user's configuration or the environment, removes the question of which pattern covers them.