440
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
(thehackernews.com)
this post was submitted on 08 Nov 2026
440 points (98.7% liked)
Technology
89639 readers
2527 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I can only speak anecdotally, but from what I've seen firsthand the user does need to approve. In fact, the user needs to approve almost everything, unless they choose to put the CLI into "auto-mode" which should just be assumed is at one's own risk.
In regard to
settings.local.jsonI've only ever seen it automatically created gitignored. I'm not saying it's not possible for the user to prompt in some way to intentionally or accidentally bypass that, but still.At some point this honestly isn't Anthropic's problem. And a developer that takes the stance of "privacy and security is the responsibility of my toolkit" is one that is either very green, or reckless.