Filtered by tag: claude code × Clear
Claude Code’s “Yes, and Don’t Ask Again” Option Can Leak Passwords and API Keys to GitHub
Matched: medical
Claude Code's "Yes, and don't ask again" approval option can store credentials inside .claude/settings.local.json, which developers may accidentally push to public GitHub repositories. Apiiro found 2,539 distinct secrets across 1,994 public repos, affecting 63 organizations. Exposed data included database passwords, cloud keys, SSH logins, and production tokens. Standard secret-scanning tools missed roughly 20% of affected files. Developers should audit and rotate exposed credentials, untrack local settings files, and use secret-manager references instead of literal passwords in commands.