CybersecurityUpdated November 9

Claude Code can save secrets in approved commands.

Choose “Yes, and don’t ask again” for a shell command in Claude Code, and the tool can save the command verbatim in a local settings file. That can include a password or API key typed into the command. The file isn’t public by default: Anthropic’s documentation says it is usually added to a developer’s global .gitignore, which generally keeps it from being shared. But if a copy reaches a public GitHub repository, the secret can go with it. Apiiro says it found 1,122 public copies of these settings files. One click meant to spare someone a repeat prompt can preserve far more than the permission they meant to give.

2 publishers2 reports

Coverage started November 7