Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

Security researchers at Apiiro found that Anthropic's Claude Code AI coding assistant saves approved shell commands containing plain-text passwords and API keys into a local settings file. The file was exposed in 1,122 public GitHub repositories, presenting security risks such as exposed database credentials and cloud keys. Researchers recommend developers remove the file from version control, rotate affected secrets, and avoid using hardcoded credentials in commands. Open article →