Filtered by tag: credential exposure × Clear
Claude Code’s “Yes, and Don’t Ask Again” Option Can Leak Passwords and API Keys to GitHub
Matched: medical
Claude Code's "Yes, and don't ask again" approval option can store credentials inside .claude/settings.local.json, which developers may accidentally push to public GitHub repositories. Apiiro found 2,539 distinct secrets across 1,994 public repos, affecting 63 organizations. Exposed data included database passwords, cloud keys, SSH logins, and production tokens. Standard secret-scanning tools missed roughly 20% of affected files. Developers should audit and rotate exposed credentials, untrack local settings files, and use secret-manager references instead of literal passwords in commands.
Tata Motors iRA App Flaws Could Let Hackers Impersonate Car Owners and Access Vehicle Services
Matched: health
India's CERT-In has flagged four high-severity flaws in Tata Motors' iRA 2.0 and iRA.ev apps. The vulnerabilities allow attackers to steal hardcoded credentials, capture authentication tokens via WebView or debug logs, and intercept network traffic through weak SSL pinning. Exploits could enable impersonation and unauthorized access to vehicle services. Users should update to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1. No active exploitation has been reported.