GoKawiilResearchers find 1,122 exposed credentials in public repos linked to Claude Code setting
Security researchers reportedly identified 1,122 public GitHub files containing exposed passwords and credentials tied to use of Claude Code's 'Don't Ask Again' permission setting. The feature appears to let the AI coding assistant bypass repeated confirmation prompts, which in these cases allowed sensitive secrets to be committed to public repositories. The finding was published via Apiiro, an AI application security firm.
GoKawiil's interpretation of the reporting above, not reported fact.
The report suggests that convenience features in AI coding tools can inadvertently weaken security guardrails that normally catch accidental credential leaks. If confirmed widely, this could pressure AI coding assistant makers to reconsider default permission behaviors, and push enterprises to add automated secret-scanning before code reaches public repositories.
- 1,122 public GitHub files reportedly contained exposed credentials linked to Claude Code usage
- The 'Don't Ask Again' setting may have suppressed warnings that would normally prevent such leaks
- Findings come from Apiiro, a firm focused on AI application security tooling
YubiKey 5C NFC Security Key — Given how easily hardcoded secrets leak from careless AI coding assistants, moving critical account logins to hardware-backed authentication like a YubiKey reduces the blast radius if credentials ever leak. It supports FIDO2/WebAuthn so even if a password or API key is exposed, your most important accounts stay protected. It's a simple, durable way to add real security hygiene alongside better secret management practices.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: apiiro.com, 2026-11-07
Published there as: “Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.