PulseAugur
EN
LIVE 00:56:03

Claude Code's "don't ask again" feature leaks secrets into public repos

By PulseAugur Editorial · [1 sources] ·

A security vulnerability has been discovered in Claude Code's "don't ask again" feature, which inadvertently saves sensitive information like tokens and passwords into public repositories. This occurs when users approve shell commands without further prompting, causing the configuration file `.claude/settings.local.json` to store secrets. While Claude Code attempts to exclude this file from Git, it only applies to the user's global git excludes, not the project's `.gitignore`, leading to potential exposure when the repository is shared. AI

IMPACT This vulnerability highlights a common security risk in AI coding assistants that remember user permissions, potentially exposing sensitive data if not properly managed.

RANK_REASON The item discusses a security vulnerability in a specific AI coding tool and a related open-source tool for auditing such vulnerabilities.

Read on r/ClaudeAI →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

Claude Code's "don't ask again" feature leaks secrets into public repos

How we ranked this

Signal score
11 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The item discusses a security vulnerability in a specific AI coding tool and a related open-source tool for auditing such vulnerabilities.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
safety, product
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [1]

  1. r/ClaudeAI TIER_2 English(EN) · /u/Predictor_2718 ·

    Heads up: Claude Code's "don't ask again" has been leaking secrets into public repos

    <!-- SC_OFF --><div class="md"><p>GitLab wrote about this a few days ago, and the number is worth repeating. Apiiro found 104,185 copies of `.claude/settings.local.json` in public repositories, and 1,122 of them had a secret in them. Here is how a secret ends up in that file.</p>…

RELATED ENTITIES

RELATED TOPICS