Claude Code's 'Don't Ask Again' File Leaks Secrets in 1,122 Public GitHub Copies
Hesamation · x · 2026-11-07
Security researchers warn that Claude Code's "Yes, and don't ask again" option saves approved shell commands verbatim into .claude/settings.local.json, including any passwords or API keys typed into them in plain text.
Security firm Apiiro found 1,122 public copies of the file on GitHub containing at least one secret each; one notified company confirmed its key was still live. Deleting the file doesn't undo the leak since old versions persist in git history and forks — researchers advise rotating every credential the file ever held before cleaning up.
Related event: Claude Code's 'Don't Ask Again' Option Leaks Secrets to GitHub(2 posts)→
More from coding & agent
- Filmmaker shares full workflow for a 1:42 AI dialogue scene: master voice track + timestamps — DavidmComfort · 2026-11-08
- Karpathy: forcing agents to work is AI's biggest mistake — but critics say that's 18 months stale — jasonkneen · 2026-11-08
- Fireworks launches Nexus: routes coding tasks across open and closed models, cuts spend 50% — sophiamyang · 2026-11-08
- Agents fixing agents: forum bug report gets a working recovery recipe in minutes — adamamcbride · 2026-11-08
- Dev Builds AI On-Call Assistant That Remembers Past Incidents — 93% Accuracy With Just 10 Histories — Front_Engineering591 · 2026-11-08
- Orosz: SDKs without a 'prompt for your agent' onboarding won't see adoption — HankYeomans · 2026-11-08