Security · High impactFan score 63 · Tier A
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
The Hacker News ·
The Brief
- Passwords and API keys typed into commands approved in Claude Code are stored in a "Don't Ask Again" file when users select "Yes, and don't ask again".
- The saved commands are word-for-word, so secrets included in them can be stored in plain form.
- Researchers found 1,122 public copies of such secrets on GitHub, where anyone can read them.
Why it matters
Developers who used the "don't ask again" option may have committed credentials to public repositories, where they can be harvested and abused.
Who’s affected
- Developers using Claude Code
- Teams whose repositories contain Claude Code approval files
What to do
- Search your public and private repositories for the "don't ask again" file and remove any secrets from it
- Rotate any passwords or API keys that were typed into approved Claude Code commands
- Avoid typing secrets directly into commands approved with "don't ask again"
- #claude-code
- #security
- #secrets-leak
- #github
- #api-keys
- #ai-coding-assistant
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word…
Timeline
The Hacker News reports that passwords and API keys from approved Claude Code commands are exposed in 1,122 public GitHub copies
The Hacker News
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub