From 67483f2b98538c3edd1ad580e3011802e9817f6c Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Sun, 29 Mar 2026 15:46:07 -0400 Subject: [PATCH] =?UTF-8?q?ops:=20operation=20voyeur=20=E2=80=94=20credent?= =?UTF-8?q?ial=20opsec=20protocol?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CLAUDE.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 416bbe2..477a5d6 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -230,6 +230,10 @@ python scripts/spam/disable_spam.py node-uuid-1 node-uuid-2 **Never access credentials without explicit instruction from fox.** This includes `pass show`, reading API key files, private keys, session cookies, tokens, or any secrets. Propose first. Fox decides. Then execute. +## Operation Voyeur + +**All comms are public** from 2026-03-29. Assume every terminal session and output is observed. NEVER display secrets to stdout. NEVER pass secrets as CLI args. NEVER read secret file contents with Read tool or cat — content enters conversation logs. **Path is fine. Content is not.** Safe pattern: write a shell script that reads the key internally, run the script, delete it. + ## Production Rules **NEVER run direct SQL or raw database commands on production.** No `sqlite3`, no `UPDATE`, no `DELETE`, no direct file edits on the production database. Ever. If the API doesn't support what you need, add the endpoint first, push it, then use the client.