diff --git a/.tasks/STATUS.md b/.tasks/STATUS.md
index d239754..128671a 100644
--- a/.tasks/STATUS.md
+++ b/.tasks/STATUS.md
@@ -78,6 +78,15 @@ _Updated: 2026-05-05 (interns-repo-read-skill-updates done — both skills 0.2.0
 
 ---
 
+## ⚪ [setup-projects-meta-token-leak] — fix token leak: `setup-projects-meta` falls back to `https://USER:TOKEN@host/...` clone URL on auth failure, persists token in `.git/config`
+**Status:** ready
+**Where I stopped:** (not started) — surfaced 2026-05-06 during factory-bootstrap field-test on fresh Win11 laptop. Phase 4 of `/setup-projects-meta` ran `git clone https://git.kzntsv.site/...` first; it failed with `Failed to authenticate user` (Bash tool runs git non-interactive; GCM not available there). Skill auto-retried with `git clone https://USER:TOKEN@host/...` — succeeded BUT git persists the URL with embedded creds in `.git/config` of the cloned repo. Two repos affected (`projects-meta-mcp`, `projects-wiki`). Field-test mitigation: PAT rotated, `git remote set-url origin <clean-url>` in both clones.
+**Next action:** in `setup-projects-meta/SKILL.md` Phase 4, replace the credential-in-URL retry with the per-invocation extraheader form: `git -c http.extraheader="Authorization: token $T" clone <url> <target>`. The extraheader is request-scoped — git does NOT persist it in the cloned repo's `.git/config`. Verify on the field-test ноуте: re-clone, `git -C <repo> config --get remote.origin.url` should print the bare URL, no token. Bump `setup-projects-meta` version (PATCH — security fix). Update SKILL.md README. Field-test artefact: `.factory/L0/install-log.md` шаг 11c-1 в gitea `OpeItcLoc03/factory`.
+**Branch:** master
+<!-- created-by: vitya@.meeting-room (director) / from: factory-bootstrap field-test / 2026-05-06 -->
+
+---
+
 ## ⚪ [refresh-project-bootstrap] — Run the `project-bootstrap` skill in this repo to refresh its layout to the canonical state (git, .gitignore, README.md, .wiki/, .tasks/, CLAUDE.md). The skill handles both greenfield bootstrap and refresh of existing repos.
 **Status:** ready
 **Where I stopped:** (not started)