GoKawiilClaude Code's permission-skipping feature exposed credentials in public repos, Apiiro finds
Security firm Apiiro reports that Claude Code's 'don't ask again' option, used to bypass repeated permission prompts for shell commands, saves the exact command—including any embedded passwords or API keys—to a local settings file. Apiiro found this file in over 100,000 public GitHub repositories, with roughly 1,100 containing exposed secrets from 63 organizations, including API tokens, database passwords, private keys and root logins.