According to Ars Technica, security firm Apiiro discovered on November 10 that over 100,000 Claude Code local configuration files were uploaded to public GitHub repositories. Approximately 1,100 files contained database passwords, API tokens, private keys, or root login credentials, exposing 2,539 real credentials across 1,994 repositories and affecting 63 organizations. The vulnerability occurs when users select "Yes, and don't ask again" prompting Claude Code to write sensitive commands to the .claude/settings.local.json file, which may then be inadvertently committed to repositories. Anthropic's Claude Code team said it is investigating preventive measures and considering implementing built-in credential scanning functionality.

View Source

Disclaimer: This content is for informational purposes only and does not constitute investment advice or encourage the buying or selling of crypto assets. It is intended to provide information about industry developments and is not directly related to the services offered by Gate TR. Although information obtained from third-party sources has been carefully reviewed, Gate TR assumes no responsibility for any errors or omissions. Crypto assets involve high risks and may experience significant price fluctuations. Before making any investment decisions, you should assess your financial situation and risk tolerance, conduct your own research, and make decisions independently.