Anthropic Claude Code 'Don't Ask Again' exposes 2,539 secrets on GitHub
Original title: Anthropic Claude Code’s ‘Don’t Ask Again’ Feature Exposes 2,539 Secrets on GitHub
Claude Code's persistent approval stores credentials in .claude/settings.local.json files committed to public GitHub repositories.
Apiiro researchers identified 2,539 distinct secrets across 1,994 public GitHub repositories linked to Claude Code. Selecting 'Yes, and don’t ask again' approval stores shell commands containing database passwords, cloud credentials, API tokens and SSH logins in .claude/settings.local.json. Among 1,105 examined repositories, 539 contained coauthored commits. Historical versions showed 734 secrets absent from current copies. The researchers did not test credentials.
Unconfirmed: The researchers did not test the credentials or contact the associated hosts.
- 2,539 secrets found in 1,994 repositories
- Impacts 63 organizations including startups and vendors
- Examples include Azure PostgreSQL production password and Square token
- File protection fails when repositories are cloned
- Gitleaks and TruffleHog missed some credential files
Impact: exposing sensitive credentials in committed files
- 1.rotate exposed credentials
- 2.inspect git history for settings files
- 3.add .claude to repository .gitignore
- Vendors
- Anthropic
- Products
- Claude Code
From the original article
2 min read at gbhackers.com
Apiiro researchers Shmulik Cohen and Matan Giladi identified 2,539 distinct secrets across 1,994 public GitHub repositories. They linked these exposures to coding agents that record sensitive commands in project files. Their research, conducted in November and updated on November 8, describes how Claude Code’s “Yes, and don’t ask again” approval option can inadvertently preserve database […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.