OPEN LINK ↗
// 54m agoSECURITY INCIDENT
Claude Code approvals expose GitHub secrets
Apiiro says Claude Code’s “Yes, and don’t ask again” approval can save exact shell commands—including passwords, API keys, and tokens—in `.claude/settings.local.json`; 1,122 of 104,185 public copies contained secrets. Including history, shared settings, and transcripts, the broader exposure reached 2,539 secrets across 1,994 repositories.
// ANALYSIS
This is a permissions UX failure more than an AI failure: a convenience toggle turns ephemeral terminal input into durable project metadata, with GitHub as the blast radius.
- –Anthropic’s local-file exclusion helps, but manually created, force-added, shared, or historical files can still expose credentials.
- –215 files evaded both gitleaks and TruffleHog, showing that inline passwords often bypass pattern-based secret scanners.
- –Developers should rotate exposed credentials first, then purge repository history, forks, and cached copies.
- –Agent permissions should redact secrets before persistence and favor environment variables or managed secret stores over inline credentials.
- –Apiiro’s comparison of 16 coding agents reportedly found Claude Code uniquely saving full approved commands to project files by default.
// TAGS
claude-codeai-codingcoding-agentsecuritysafetydevtoolcli
DISCOVERED
54m ago
2026-11-08
PUBLISHED
4h ago
2026-11-07
RELEVANCE
10/ 10
AUTHOR
shmulc