AnalysisDevelopersNovember 7, 2026

Claude Code settings file leaks secrets in 1,122 public GitHub copies

Read original source →thehackernews.com

Apiiro found 1,122 public copies of .claude/settings.local.json containing at least one password, token, or API key saved verbatim by "Yes, and don't ask again" allow rules. One notified company confirmed its key was live; removing the file doesn't undo the leak since git history and forks retain it.

1 source

More stories today

Open the live feed