Security · 8 November 2026
Anthropic Claude Code 'Don't Ask Again' feature leaks passwords in 1,122 public GitHub files
Claude Code's 'Yes, and don’t ask again' option saves approved commands—including passwords and API keys—to .claude/settings.local.json, resulting in 1,122 public GitHub copies exposing at least one secret each.
Why it matters
Update onboarding docs to warn users that 'Don't Ask Again' saves commands with secrets; customers will expect safe defaults.
For product managers
For your product
What does this mean for your product?
Try it on your product More from this issueAll AI news from 8 Nov →
Get this every morning, written for your product.
Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.