News for hackers. Stuff that matters.

A comment on Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files. Parent comment

Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by bmitc on Saturday November 07, 2026 @09:02PM (#50409854)
> day 1 security best practices say you don’t write secrets to files

If only tools, including major ones, actually did that. Plenty of the biggest package managers in the world still write API keys in plain text to files. uv and npm are two of them.

[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by JohnMakin on Sunday November 08, 2026 @02:29AM (#50411154)
and we can disable those for better alternatives. npm executes arbitrary code based on what the package said, obviously bad

claude unleashed on an organization is a whole other beast.

[ Parent | on HN ]