[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsDiKEAgv01KUfHi16Kr_DJLKg_x2cWYsIc6-GJDP7iA":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"8132592d-4556-40fc-a77d-d3fda81b3d83","Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub","claude-code-s-don-t-ask-again-file-exposes-passwords-and-keys-in-1-122-public-co-9989e9","Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects \"Yes, and don't ask again,\" Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public","Anthropic's Claude Code AI assistant has a feature that, when enabled, saves user commands, including sensitive information like passwords and API keys, into project settings files. A security analysis revealed that 1,122 public GitHub repositories now contain these exposed secrets, making them accessible to anyone.","Claude Code's 'Don't Ask Again' feature saves commands with secrets to public GitHub repos.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fclaude-codes-dont-ask-again-file.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhZH3vYLZb9lP7mDLqy2h-upzdComeWIfjDX5siFUO3FM2HlUs03OTwirA1R2uzOZq_clptIVBsoaJNXIuf8LlTbXHFvzBJLRl1l3mqGVesHjgdmD86S_c-k2JY_t56xZqI0bnN6jXRDr92KlMw6X5BHzm5hqogpWflsERi9zrsMHSS_abAcvZMcUGovd8\u002Fs1600\u002Fclaude-code.jpg","2026-11-07T06:44:17+00:00","2026-11-07T08:00:34.751166+00:00",8,[17,20,23,26],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":22},"Anthropic","vendor",{"name":24,"type":25},"AI coding assistant","technology",{"name":27,"type":19},"GitHub","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[21,18,27],{"controls":54,"vendors":138},[55,83,112],{"slug":56,"name":57,"problem":58,"products":59},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":77,"vendor_name":27,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":84,"name":85,"problem":86,"products":87},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":113,"name":114,"problem":115,"products":116},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[117,123,131],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":113,"product_name":135,"url":136,"description":137},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"claude-code-ai-tool-leaks-secrets-into-1122-public-github-repos","Claude Code AI Tool Leaks Secrets into 1,122 Public GitHub Repos","Anthropic's Claude Code assistant includes a 'Don't Ask Again' feature that persists user-approved commands — including passwords and API keys — into project-level settings files. When developers commit these files to public GitHub repositories without understanding what data is being stored, those secrets become instantly accessible to anyone on the internet. This incident illustrates a dangerous gap between developer convenience features and secure-by-default design: tools that silently write sensitive data to disk can inadvertently automate secret exposure at scale. The core failure is two-fold — the tool's default behavior was not sufficiently protective, and many users lacked awareness that committing project settings files could expose credentials.",[144,145,146,147,148,149,150],"CIS Control 3: Data Protection","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","OWASP A06:2021 Vulnerable and Outdated Components",{"GDPR Article 32":152,"CIS Control 3: Data Protection":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"OWASP A06:2021 Vulnerable and Outdated Components":155,"CIS Control 14: Security Awareness and Skills Training":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"If any of the exposed credentials provide access to systems holding personal data, their public disclosure constitutes a failure to implement appropriate technical measures to ensure data security, triggering potential breach-notification obligations.","Sensitive credentials written to project files and committed publicly represent a failure to classify and protect sensitive data at rest; CIS Control 3 requires organisations to identify, classify, and protect data to prevent unauthorised disclosure.","The tool's insecure default behaviour of writing secrets to commitable files represents a software flaw that vendors and adopting organisations should track and remediate through formal flaw-management processes.","Integrating a third-party AI tool without evaluating its data-handling behaviour mirrors the risk of adopting components without security review; OWASP A06 highlights the need to vet all third-party software for security properties before use.","Developers were unaware that Claude Code's convenience feature persisted secrets to disk files; targeted training on AI tool risks and version-control hygiene would have prevented the accidental commits.","The insecure default configuration of Claude Code is a known technical vulnerability that organisations adopting the tool should assess, track, and mitigate as part of their vulnerability management programme.","Exposed API keys and passwords directly undermine credential integrity; this function requires that credentials be protected throughout their lifecycle, including during storage by developer tooling."]