Claude Code is accidentally exposing secrets all over GitHub
"Do not ask again" prompt leads to passwords, API keys, and more being shared.
- 1. Claude Code settings files uploaded to public GitHub repositories exposed credentials across dozens of organizations.
- 2. The vulnerability occurs when automated command approvals write sensitive arguments directly into configuration files that can be inadvertently committed to version control.
- 3. Claude Code developers acknowledged the issue and stated they are considering integrated secret scanning to prevent future repository leaks.
Catch up on Ars Technica articles in minutes
skim analyzes recent Ars Technica coverage for what holds up, what reads as opinion, and what may not be fully supported. Last updated 9th November 2026.