Claude Code Stores OAuth Tokens in Plaintext (secretspec.dev)

Claude Code, despite claiming secure storage of authentication tokens, currently stores OAuth tokens in plaintext JSON files on Linux systems, leading to potential security vulnerabilities. The tokens are stored in the file ~/.claude/.credentials.json with permissions set to 0600, but this does not adequately protect sensitive credentials from unauthorized access. While the service utilizes OAuth for credential discovery and management, the lack of a secure local vault means tokens remain exposed, undermining the primary benefits of OAuth in credential delegation. This revelation is significant for the AI/ML community as it highlights a critical gap in security practices regarding sensitive data management in applications. It suggests that Claude Code needs to adopt a more robust credential storage solution, such as integrating with SecretSpec, which offers various secure storage options. This could provide a scalable method for handling OAuth tokens securely, rather than relying on a singular plaintext file approach, thus enhancing the overall security of open-source software and mitigating risks associated with token theft or exposure.