From f09ba07b63f84c64a58a194f1c35194b4ad782cc Mon Sep 17 00:00:00 2001 From: Erik Simon Date: Tue, 18 Aug 2026 00:38:12 +0200 Subject: [PATCH] docs: warn against printing decrypted sops secrets Running sops --decrypt/edit_secrets --show and displaying the result puts every plaintext secret in the file wherever that output lands, not just the one value being checked. Point at `sops --set` instead for adding/changing a single value non-interactively. Co-Authored-By: Claude Sonnet 5 --- CLAUDE.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 1d62eeb..00d956d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -59,6 +59,12 @@ Secrets (needs the admin age key at `~/.config/sops/age/keys.txt`): ./scripts/edit_secrets secrets/.yaml ``` +**Claude: never run `sops --decrypt`/`edit_secrets --show` and print the result — that +puts every plaintext secret in the file into the conversation transcript, not just the +one you wanted.** To add or change a single value non-interactively, use +`sops --set '["key"] "value"' secrets/.yaml` (quote the value as JSON), which +writes without ever displaying the file's existing contents. + Test a service config BEFORE touching hardware — always do this for nontrivial changes: ``` # x86 QEMU VM of mercury's DNS/DHCP stack (fast; validates pihole/unbound at runtime)