Claude Code's "don't ask again" button is leaking passwords and API keys to public GitHub repos

Serving tech enthusiasts for over 25 years.
TechSpot means tech analysis and advice you can trust.

Facepalm: A feature in Claude Code meant to save developers a few clicks is exposing database passwords, API tokens and private keys in public GitHub repositories. When a developer tells Anthropic's coding agent to stop asking for permission to run a shell command, the agent saves the exact command, along with any credentials inside it, to a settings file in the project folder. Researchers at security firm Apiiro found that file in more than 100,000 public repositories, and about 1,100 of them contained secrets.

Claude Code asksfor approval before it runs shell commands on a developer's machine. One of the options is "Yes, and don't ask again." Choosing it creates an allow rule in a file called .claude/settings.local.json. Sometimes the rule is a general pattern, but often it's the full command, stored...

Copyright of this story solely belongs to www.techspot.com. To see the full text click HERE