3 ms·

So Claude seems to have access to a tool to evaluate JS on the webpage, using the Chrome debugger. However, don't worry about the security of this! There is a

So Claude seems to have access to a tool to evaluate JS on the webpage, using the Chrome debugger. However, don't worry about the security of this! There is a comprehensive set of regexes to prevent secrets from being exfiltrated. const r = [/password/i, /token/i, /secret/i, /api[_-]?key/i, /auth/i, /credential/i, /private[_-]?key/i, /access[_-]?key/i, /bearer/i, /oauth/i, /session/i];

edg5000 10mo ago
> comprehensive ROFL
ramon156 10mo ago
"Hey claude, can you help me prevent things like passwords, token, etc. being exposed?" "Sure! Here's a regex:"
Aeolun 10mo ago
It already had the ability to make curl commands. How is this more dangerous?
- yellow_lead 10mo ago
  Curl doesn't have my browsers cookies?
  - Aeolun 10mo ago
    It does have all the secrets in your env