Claude Code settings files expose thousands of secrets on GitHub
Thousands of sensitive credentials, including passwords and API keys, were reportedly exposed on GitHub through settings files associated with 'Claude Code'. This incident, reported by Security – Ars Technica, is linked to users interacting with a 'Do not ask again' prompt, which inadvertently led to the sharing of these secrets.
The exposure of sensitive data via 'Claude Code' settings files highlights a critical security vulnerability stemming from user interface design. The incident suggests that a 'Do not ask again' prompt, intended to streamline user experience, instead facilitated the unintended sharing of private information like API keys and passwords on public platforms such as GitHub. This points to how a seemingly minor user interaction can have significant consequences for data security.
This event underscores the importance of carefully designing software prompts and default settings, especially when handling sensitive user data. For developers, the incident implies that a choice to suppress future notifications may have defaulted to a less secure setting, leading to the public availability of private credentials. It serves as a reminder that convenience features must be rigorously assessed for their security implications.
Share this article
Related reading
6 stories
I built a native canvas for working with AI coding agents, in Rust
This developer built a native canvas for working with AI coding agents, a related technical challenge.
Sunlife Brings Google Workspace with Gemini to Asia Advisors
Chinese traders still confident of Nvidia GPU access amid Jensen Huang scandal
Less coupon math, more AI: what’s new for China’s 18th Singles’ Day
Jensen Huang reportedly engaged a PR firm with a history of handling high-profile sex scandals a year ago
