News for hackers. Stuff that matters.

A comment on Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files. Parent comment

Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by cassianoleal on Saturday November 07, 2026 @05:17PM (#50408583)
From TFA:

> Often Claude commits the file itself. In 539 of the 1,105 repos with a real secret that we traced, a commit co-authored by Claude changed the file. Those commits name every recent model, from Sonnet 4.5 to Opus 5.5.

Could open source harnesses do that? Sure, if they were programmed in a similar fashion as Claude Code. Do you have any evidence of it happening?

[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by ceejayoz on Saturday November 07, 2026 @05:44PM (#50408742)
Of course an open source harness can put secrets into a commit.

Humans do it!

[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by skeledrew on Saturday November 07, 2026 @05:45PM (#50408747)
Nothing stops someone from committing secrets to public repos, with or without AI. Unless guardrails are put in place that scans repos before push, and only people already wary of secrets leaking would setup said guardrails in the first place.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by happyopossum on Saturday November 07, 2026 @05:50PM (#50408779)
The file is .gitignored if Claude creates it - any commits by Claude would be due to someone overriding that or creating it themselves incorrectly.

None of this has anything to do with open vs. closed source.

[ Parent | on HN ]