H
pending
Verification That Ships With the Tool vs. Glue You Have to Maintain
Grounded / Real
Inflated / Uruttu
Original Content
Claude Code commits leak secrets 2x more than humans.
(28M hardcoded secrets shipped to GitHub in 2025)
GitGuardian tracked every public commit on GitHub last year and found Claude Code-assisted commits leaked credentials at 3.2%, against a 1.5% human baseline.
Karpathy described vibe coding as "fully givegiving in to the vibes, embrace exponentials, and forgetting that the code even exists." When you stop reading diffs, you stop seeing what went into them.
A key you pasted into the prompt for context gets written into a config file, and the agent has no reason to treat it differently from any other string.
Most people end up wiring the verification themselves. A pre-commit hook that shells out to a scanner, or a script that pipes findings back into the agent's context.
Both are glue you now maintain, and both run outside the session where the code gets written.
SonarQube (by Sonar) ships a CLI that removes the glue entirely, and one command wires it into Claude Code:
```
sonar integrate claude -p <your-project>
```
That registers the hooks and configures the SonarQube MCP server in the same step, which gives you three layers running against the agent's work:
→ Secrets detection runs on every prompt you submit and every file the agent reads or writes.
→ Static analysis checks whatever your agent just wrote, using the same rules a full CI scan would apply.
→ The MCP server puts those findings in Claude's context, so it reads its own issues and fixes them.
Secrets detection and the MCP server both work on the SonarQube free tier, while the deeper code analysis and verification layer with is part of Sonar Vortex requires a paid plan with the proper entitlement
In the video below, a real-format GitHub token gets intercepted at prompt submission, before the model ran.
Every DIY setup works until the agent's workflow changes and the glue quietly stops firing. Verification that ships with the tool doesn't have that failure mode.
Link to the GitHub repo in the first comment.
_____
Share this with your network if you found this insightful ♻️
Follow me Akshay Pachaar for more insights and tutorials on AI and Machine Learning!
(28M hardcoded secrets shipped to GitHub in 2025)
GitGuardian tracked every public commit on GitHub last year and found Claude Code-assisted commits leaked credentials at 3.2%, against a 1.5% human baseline.
Karpathy described vibe coding as "fully givegiving in to the vibes, embrace exponentials, and forgetting that the code even exists." When you stop reading diffs, you stop seeing what went into them.
A key you pasted into the prompt for context gets written into a config file, and the agent has no reason to treat it differently from any other string.
Most people end up wiring the verification themselves. A pre-commit hook that shells out to a scanner, or a script that pipes findings back into the agent's context.
Both are glue you now maintain, and both run outside the session where the code gets written.
SonarQube (by Sonar) ships a CLI that removes the glue entirely, and one command wires it into Claude Code:
```
sonar integrate claude -p <your-project>
```
That registers the hooks and configures the SonarQube MCP server in the same step, which gives you three layers running against the agent's work:
→ Secrets detection runs on every prompt you submit and every file the agent reads or writes.
→ Static analysis checks whatever your agent just wrote, using the same rules a full CI scan would apply.
→ The MCP server puts those findings in Claude's context, so it reads its own issues and fixes them.
Secrets detection and the MCP server both work on the SonarQube free tier, while the deeper code analysis and verification layer with is part of Sonar Vortex requires a paid plan with the proper entitlement
In the video below, a real-format GitHub token gets intercepted at prompt submission, before the model ran.
Every DIY setup works until the agent's workflow changes and the glue quietly stops firing. Verification that ships with the tool doesn't have that failure mode.
Link to the GitHub repo in the first comment.
_____
Share this with your network if you found this insightful ♻️
Follow me Akshay Pachaar for more insights and tutorials on AI and Machine Learning!
Validated Content
Highly accurate throughout — statistics, product mechanics, and the Karpathy quote all check out, with one minor quoting slip.
- "Claude Code commits leak secrets 2x more than humans" / "3.2% vs 1.5% baseline" — confirmed precisely. GitGuardian's State of Secrets Sprawl 2026 report found Claude Code-assisted commits leaked secrets at approximately 3.2%, roughly double the 1.5% baseline rate across all public GitHub commits.
- "28M hardcoded secrets shipped to GitHub in 2025" — accurate, very close to the exact figure. GitGuardian's report states 28.65 million new hardcoded secrets were added to public GitHub commits in 2025, a 34% year-over-year increase and the largest single-year jump on record. Some coverage rounds this to "29 million," so "28M" is actually the more precise figure.
- "GitGuardian tracked every public commit on GitHub last year" — accurate framing of the report's scope; it's based on public GitHub-wide commit analysis, not a sample.
- Karpathy vibe coding quote — the underlying idea and sourcing (Karpathy, February 2025, describing vibe coding) is accurate, but the quote itself is slightly garbled in transcription. The actual quote is: "fully give in to the vibes, embrace exponentials, and forget that the code even exists." The post renders this as "fully givegiving in to the vibes, embrace exponentials, and forgetting that the code even exists" — a typo ("givegiving") and altered verb tense ("forgetting" vs. "forget"). Worth cleaning up before publishing since it's presented as a direct quote.
- SonarQube CLI command:
sonar integrate claude -p <your-project>— accurate. This is a real, documented command that installs secrets-detection hooks (UserPromptSubmit and PreToolUse) and configures the SonarQube MCP server for Claude Code in a single step, exactly as described. - "Secrets detection runs on every prompt you submit and every file the agent reads or writes" — accurate. The UserPromptSubmit hook scans prompt text before submission, and the PreToolUse hook scans before Claude reads or writes files.
- "Static analysis... using the same rules a full CI scan would apply" / "MCP server puts findings in Claude's context" — accurate description of how the deeper agentic analysis layer (Sonar Vortex) and MCP server integration work together.
- "Secrets detection and MCP server work on the free tier, deeper analysis requires a paid plan with entitlement" — accurate. The agentic analysis (Vortex) layer is explicitly gated to SonarQube Cloud with an organizational entitlement, while secrets scanning and the MCP server work more broadly.