alt Hacker News> day 1 security best practices say you don’t write secrets to files
If only tools, including major ones, actually did that. Plenty of the biggest package managers in the world still write API keys in plain text to files. uv and npm are two of them.
> day 1 security best practices say you don’t write secrets to files
If only tools, including major ones, actually did that. Plenty of the biggest package managers in the world still write API keys in plain text to files. uv and npm are two of them.
and we can disable those for better alternatives. npm executes arbitrary code based on what the package said, obviously bad
claude unleashed on an organization is a whole other beast.