Technology & AI
Claude Code is accidentally exposing secrets all over GitHub
Source: Ars Technica - All content · Published
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets , including database passwords, API tokens
Claude Code is leaking sensitive information on public GitHub instances thanks to a partial oversight in the way its settings files are handled. That's the finding of AI security researchers at Apiiro, who discovered thousands of secrets , including database passwords, API tokens, and root logins, amid Claude Code settings files embedded in GitHub repositories. The leak stems from the way Claude Code handles user approval for automated shell commands.
When a user chooses the "Yes, and don't ask again" option to approve running a command, that choice gets stored as part of a rule in the local ".claude/settings.local.json" file on the user's computer. That rule is sometimes coded as a pattern, but the command itself is often written to that settings file as is, including any sensitive information that may be embedded within it. This isn't really a significant security issue if the settings file stays on the user's local machine (assuming that machine doesn't become compromised itself, of course).
And Anthropic notes in its Claude Code documentation that this particular settings file gets added to the developer's global .gitignore list , which usually prevents it from being shared publicly. Read full article Comments
Related stories
AI Gets Dramatically Cheaper: Inference Prices Fall by Up to 80% as Open-Weight Rivals Force a Price War
OpenAI and Anthropic have cut the cost of running their flagship models by up to 80% since June, driven by DeepSeek competition and efficiency gains, while IBM argues open-weight models now deliver 90% of frontier performance at a fraction of the cost.
Pulse Wire ·
Elvis Presley's Rights Owners Sue Anthropic Over 274 Songs Used to Train Claude
The owners of Elvis Presley's music catalogue have sued Anthropic, alleging Claude was trained on 274 songs without permission, seeking up to $150,000 per song — about $41.1 million — in a case that could shape how AI companies use music.
Pulse Wire ·
You can grab three months of Game Pass Ultimate for under $20 per month
The price of Xbox Game Pass Ultimate has fluctuated between $20 and $30 per month over the last year, but you can get three months of the top plan for around $19 per month. At Newegg , using the coupon code BNWF2656 at checkout knocks $11 off the usual cost of a three-month subsc
The Verge ·
How does Google Wallet's notification feed work and can you disable it?
Google Wallet is attempting to make notifications easier to find with a notification feed, but if you're sick of alerts, find out how to disable them.
Engadget - Technology News & Expert Reviews ·
Jensen Huang’s affair with alleged Chinese spy puts Nvidia’s China ambitions under scrutiny
Jensen Huang’s alleged affair with a suspected Chinese spy threatens to complicate Nvidia’s lobbying efforts to loosen U.S. chip export restrictions and maintain access to China’s lucrative AI market.
TechCrunch ·