NewsThe Hacker News
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
More on GitHub
Other advisories
- HighCVE-2026-123852JetBrains Junie GitHub Action: fehlerhafte Autorisierung
- MediumCVE-2026-123851JetBrains Junie GitHub Action: Sicherheitslücke
- HighCVE-2026-123852JetBrains Junie GitHub Action: fehlerhafte Autorisierung
- MediumCVE-2026-123851JetBrains Junie GitHub Action: Sicherheitslücke
- Highpwn_watch:claude-code-settings-local-json-secrets-exposure-nov-2026Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets
- HighCVE-2026-110288Microsoft GitHub Enterprise Server: Mehrere Schwachstellen
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-116587CVE-2026-116587 in github.com/go-jose/go-jose/v4 - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-34986CVE-2026-34986 in github.com/go-jose/go-jose/v4 - Patched by Root
Other news entries
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsBreachpwn.watch
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
- Fake security tools on GitHub push backdoors and infostealersNewsBleepingComputer
- Threat actors use agentic AI tooling to find and abuse exposed secretsNewsMicrosoft Threat Intelligence
- Microsoft GitHub Enterprise Server: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secretsBreachpwn.watch
- Hugging Face malware campaign returns to hijack GPUs for crypto miningNewsBleepingComputer
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto MinersNewsThe Hacker News
Source: https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
ID