A security vulnerability has been discovered in Claude Code, a feature within Anthropic's AI assistant, where sensitive information like passwords and API keys can be inadvertently saved. When users approve commands with the "Yes, and don’t ask again" option, these commands are stored verbatim in a local settings file. While Claude Code attempts to add this file to the global git ignore, it does not prevent secrets from being exposed if the file is already tracked by git, if a folder is later turned into a repository, or if a teammate clones the project. Security researchers found over a thousand instances of this file on GitHub containing exposed secrets. AI
IMPACT Exposes sensitive user data, potentially leading to account compromises and data breaches.
RANK_REASON Security vulnerability discovered in a specific feature of an AI product.
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
