Apiiro finds 1,122 public GitHub files with secrets saved by Claude Code
Security firm Apiiro reported yesterday that 1,122 public copies of the file .claude/settings.local.json on GitHub contain at least one secret, such as passwords, API keys, or tokens. The file is created when a developer using Anthropic's Claude Code coding assistant selects "Yes, and don't ask again" for a shell command; the exact command, including any secret typed into it, is saved in plain…
Key points
- 1,122 public .claude/settings.local.json files on GitHub contain at least one secret, Apiiro says
- 1,379 distinct secrets found, including 379 database passwords and 23 AWS keys
- Claude Code saves the exact approved command with secrets when users pick "don't ask again"
Model page: Opus 5.5 →
The story so far
2 episodes →- Apiiro finds 1,122 public GitHub files with secrets saved by Claude Codethis story
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
thehackernews.com · 6 November 2026
Loading the full article…
This text was published by thehackernews.com and written by The Hacker News. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Generative AI & Models
All →- Thinking Machines releases Inkling 2 Small, a 594B MoE model with 17B active parameters · 8 src
- OpenAI releases GPT-6 Cyber, a Critical-rated model that outperforms predecessors in vulnerability detection and alignment · 25 src
- Google releases Gemini Omni 1.2 Flash with 15-second video generation and 30% price cut to $0.07 per second · 10 src
- US accuses Chinese executive of allegedly sharing Nvidia chip info with Beijing · 11 src
- Moonshot AI releases Kimi K3.1 Pro as open-weights model · 2 src
Comments
via GitHub Discussions