Claude Code config found to store leaked credentials
What happened
On November 8, 2026, Hacker News' front page covered Apiiro's research on credential leaks in Claude Code. When a user picks the "don't ask again" option, Claude Code writes the full command, credentials included, into the local config file .claude/settings.local.json, so secrets stay in the config. Apiiro found 1,122 public files on GitHub containing such secrets, showing that public config files have already exposed credentials.
Written by AI from the coverage · updated 4 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pagePickApiiro finds Claude Code's "don't ask again" setting exposed credentials in 1,122 public GitHub files
Apiiro found that Claude Code's "don't ask again" option writes the full command, credentials included, into .claude/settings.local.json. On GitHub, 1,122 public files contain such secrets.
Heat over time
Heat now 9·Comparable peak 10（Nov 8 06:00）·Comparable change over 24 hours –
The trend only compares accounts observed without gaps, so its range may be smaller than the current heat. Hover or tap the chart for each hour; the left and right arrow keys step through it.