Cybersecurity · 2 views
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Claude Code saves secrets in approved commands, exposing 2,539 credentials across 1,994 public GitHub repositories, Apiiro finds.
AI Summary
Passwords and API keys entered by developers into commands approved in Claude Code are now stored in public GitHub repositories. When a user selects “Yes, and don’t ask again,” Anthropic’s AI coding assistant saves the command exactly as typed, including any secrets, in a project settings file. The file is then pushed to GitHub, making the credentials readable by anyone who can access the repository. This exposure affects 1,122 public copies of the file, allowing unrestricted access to the stored secrets.
AI summaries can be wrong sometimes—always verify important details using the source article.
How AI & Automation are usedMore from Cybersecurity
Continue reading recent Cybersecurity coverage
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacksContinue reading
- UK Wades Into Tech Sovereignty Amid AI Policy ChangesContinue reading
- OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugsContinue reading
- Fake security tools on GitHub push backdoors and infostealersContinue reading
Support HappeningNow
Independent AI-powered news analysis is reader-supported. Your contribution helps cover infrastructure, summaries, and continued platform development.
Support HappeningNow