Security · High impactFan score 64 · Tier A4 sources

Claude Code's "Don't Ask Again" Leaked Developers' Secrets to Public GitHub — Explained Honestly

The Brief · written from 4 sources

Passwords and API keys typed into commands approved in Claude Code can be saved word-for-word when a user selects "Yes, and don't ask again".
The saved approvals are sitting in 1,122 public copies on GitHub, where anyone can read them.
The reporting refers to Anthropic's AI coding assistant, Claude Code.

Why it matters

Developers who approved commands containing credentials may have leaked those secrets into public repositories, which means exposed keys should be treated as compromised.

Who’s affected

Claude Code users who selected "Yes, and don't ask again"
Developers whose repositories contain saved Claude Code approval files

What to do

Search your repositories for the Claude Code "don't ask again" approval file and remove any credentials stored in it.
Rotate any passwords or API keys that were typed into approved Claude Code commands and may have been committed publicly.

#claude-code
#security
#secrets-leak
#github
#api-keys
#ai-coding-assistants

Here is a security story with no villain, no hack, and no prompt injection — just an ordinary click. You ask Claude Code to check a database or call an API. It proposes a shell command carrying the password or token, and asks before running it. You pick "Yes, and don't ask again"…

Read the full story at dev.to ↗