NewsArs Technica — Security
Claude Code is accidentally exposing secrets all over GitHub
Teaser from the source
"Do not ask again" prompt leads to passwords, API keys, and more being shared.
This is the RSS-feed teaser. Read the full article at the original source.
Read at Ars Technica — SecurityMore on GitHub
Other advisories
- HighCVE-2026-102289zizmor: Debug logging prints available GitHub credentials in cleartext
- HighCVE-2026-124621Kongxin-github Java_Library_Management_System: fehlerhafte Rechtevergabe
- HighCVE-2026-124621Kongxin-github Java_Library_Management_System: fehlerhafte Rechtevergabe
- HighCVE-2026-123852JetBrains Junie GitHub Action: fehlerhafte Autorisierung
- MediumCVE-2026-123851JetBrains Junie GitHub Action: Sicherheitslücke
- HighCVE-2026-123852JetBrains Junie GitHub Action: fehlerhafte Autorisierung
- MediumCVE-2026-123851JetBrains Junie GitHub Action: Sicherheitslücke
- Highpwn_watch:claude-code-settings-local-json-secrets-exposure-nov-2026Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets
Other news entries
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsBreachpwn.watch
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubNewsThe Hacker News
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
- Fake security tools on GitHub push backdoors and infostealersNewsBleepingComputer
- Threat actors use agentic AI tooling to find and abuse exposed secretsNewsMicrosoft Threat Intelligence
- Microsoft GitHub Enterprise Server: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- GitBook breach: SSO flaw led to production access; all API tokens revoked, rotate integration secretsBreachpwn.watch
- Hugging Face malware campaign returns to hijack GPUs for crypto miningNewsBleepingComputer
Source: https://arstechnica.com/ai/2026/11/claude-code-settings-files-expose-thousands-of-secrets-on-github/
ID