docs(agent): clarify claude oauth env

2026-05-28 18:20:09 -04:00
parent cacba087c9
commit cdb1870b1c
14 changed files with 41 additions and 40 deletions
@@ -88,7 +88,7 @@ already on the attacker's box. Detection has to be at *commit* time
 Two surfaces are exposed:

 1. **The bot-bottle repo itself.** Development happens on a host
-   with `BOT_BOTTLE_OAUTH_TOKEN`, Gitea tokens, and other
+   with `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`, Gitea tokens, and other
   credentials in the environment. A fixture, test snapshot, log
   capture, or pasted-in debug output could carry one of them into a
   tracked file. The repo's Gitea remote is private, but mirrors or