Claude Code SessionStart hook dumps full os.environ (incl. API keys) to world-readable /tmp/mgrep-watch.log

[kankunnawat]

Summary

hooks/mgrep_watch.py in the Claude Code plugin logs the entire process environment on every session start:

debug_log(f"Started mgrep watch process: {process.pid}")
debug_log(f"All environment variables: {os.environ}")

DEBUG_LOG_FILE defaults to /tmp/mgrep-watch.log, created with mode 644 in a world-readable directory. Claude Code sessions inherit the user's full shell environment, so every API key / token exported in the user's profile (ANTHROPIC_API_KEY, cloud credentials, etc.) ends up in plaintext where any local user or process can read it. The log is also append-only in practice — on my machine it had grown to 5.2 MB of repeated environment dumps over two weeks.

Environment

• mgrep 0.1.10, Claude Code plugin (Mixedbread-Grep marketplace), macOS

Suggested fix

• Remove the os.environ debug line entirely (it logs secrets by design, even when nothing is wrong), or gate it behind an explicit opt-in env var with redaction.
• Create the debug log with mode 600, and prefer a user-private location (e.g. ~/.mgrep/logs/) over /tmp.

Users who have run the plugin should assume any env-exported secrets were exposed to local processes and rotate them after deleting /tmp/mgrep-watch.log.