Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by JohnMakin on Saturday November 07, 2026 @07:14PM (#50409326)

It doesn’t matter if they should stay local, day 1 security best practices say you don’t write secrets to files, ever - especially without you even knowing!

This is such a typical blame the user response. You realize if I’m a sysadmin managing fleets of machines, this is an actual wake up in a cold sweat nightmare, even if those files never leave disk? In the past it was less a big deal, way bigger now that your machine god will just download packages and libs that have upstream malware that aggressively scans the file system for stuff like this. guess where it’s going to look first?

have more humility. jesus.

[ Parent | on HN ]

Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by bmitc on Saturday November 07, 2026 @09:02PM (#50409854)

> day 1 security best practices say you don’t write secrets to files

If only tools, including major ones, actually did that. Plenty of the biggest package managers in the world still write API keys in plain text to files. uv and npm are two of them.

[ Parent | on HN ]

Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by JohnMakin on Sunday November 08, 2026 @02:29AM (#50411154)

and we can disable those for better alternatives. npm executes arbitrary code based on what the package said, obviously bad

claude unleashed on an organization is a whole other beast.

[ Parent | on HN ]