YHK - yet another hacker news clone

Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

34 points shmulc 58 minutes ago 18 comments

qezz 36 minutes ago | parent

  > Is it public? 
  > 
  > Search your GitHub organization for .claude/settings.local.json and .claude/settings.json. Each hit is a file anyone can read right now.
So, it's not necessarily "public", it's simply in the repository, and whether it's actually public or not depends on the repository settings.

Or am I missing something

Aurornis 34 minutes ago | parent

Confusing headline. They scanned for repos where people had committed their .claude/ folder and local settings and then scanned those files for commands which contained keys or passwords.

So pressing “Don’t Ask Again” by itself doesn’t expose passwords by itself. If you commit your local Claude settings and in those settings you have manually approved commands containing secrets directly in the command and then you publish the repo, that’s exposed.

lacoolj 33 minutes ago | parent

This page is like 80% repeating itself

If you post output from AI, please remember to edit before publishing

NooneAtAll5 30 minutes ago | parent

don't edit Ai garbage - make Ai your editor that points out mistakes instead

rvz 31 minutes ago | parent

Vibe coders in open source proudly don't read the (slop)code and place all their agents in autonomous loops without them knowing that Claude leaked their passwords and environment variables on GitHub.

This incident would have been caught in an open source harness. This one is closed source malware, and you don't know what Claude Code does internally to behave like this.

Yet another reason why you cannot trust a closed harness.

happyopossum 28 minutes ago | parent

That’s ridiculously overblown rhetoric. Claude Code didn’t publish these secrets, the users did by committing their Claude Code settings to public repos.

Same thing could/would happen with an open source harness.

jedisct1 31 minutes ago | parent

If you really need to commit private files to GitHub, use Turbocrypt https://github.com/jedisct1/turbocrypt/blob/main/docs/git.md

bcherny 29 minutes ago | parent

Boris from the Claude Code team here. Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this.

That said, a few thoughts:

1. .claude/settings.local.json is meant to stay local. This is not a file you should check into source control. We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in (docs: https://code.claude.com/docs/en/settings)

2. Permission rules are old hat. Everyone should be using auto mode instead. It is safer and also does not require manually maintaining finicky allow/deny lists. Auto mode is enabled by default and is included for free in all plans.

3. Regardless of what agent you use, you should have secret scanning enabled. GitHub and other source control hosts offer it. There are many threat models that it protects against and you should absolutely use it if you can. (see https://github.com/security/plans)

agentdev001 23 minutes ago | parent

I appreciate you getting communication out in front of this fast.

> "but we are looking into what we can do to prevent this"

I would presume that CC's auto-review of tool-call turns would already solve this >99% of the time, no? From my read, any harness-side deterministic solution here would be saving the user from themselves, which seems like a bad pattern. Somewhat dulling the scalpel in my mind.

bcherny 21 minutes ago | parent

There’s a few possible approaches: making sure auto mode catches this, building in basic secret scanning, a few other ideas. Going to prototype a few of these to understand the tradeoffs better before we ship something.

markasoftware 21 minutes ago | parent

Auto mode cannot be considered safer than anything because it does not even attempt to guarantee any sort of security. The threat model is not even defined. It cannot be quantified or compared with any other approach other than "full access"

bcherny 14 minutes ago | parent

Auto mode is significantly safer than manual approval in practice. Details about the engineering approach and how we tested whether it is safer here: https://claude.com/resources/articles/auto-mode-default-in-c....

bluebands 18 minutes ago | parent

This still presumably happens in auto mode as it asks for sensitive commands (and the default is "always allow," which saves it)

bcherny 13 minutes ago | parent

Yeah good catch. Thinking through what we can do to improve this (ideas welcome).

mococa 17 minutes ago | parent

This crapware should NEVER store secrets at $PWD. Period.

GeoAtreides 29 minutes ago | parent

"git add . " considered harmful

flufluflufluffy 25 minutes ago | parent

This just in checking your secrets into source control exposes your secrets!