When CLAUDE.md Isn't Enough: Claude Code's Three Secret Exposure Pathways

While developers often assume advisory rules like CLAUDE.md protect their credentials, Claude Code can leak API keys through three mechanisms: direct file reads, runtime error capture, and search functions. Only hard deny rules in settings.json provide actual protection, making this security gap critical for anyone using Claude Code with production secrets.