The Hacker News · Nov 7, 2026 · 7:22 AM

Apiiro: Claude Code "don't ask again" left secrets in 1,122 public GitHub copies

Apiiro found 1,122 public .claude/settings.local.json copies holding at least one secret (1,379 distinct, including 379 database passwords) after "Yes, and don't ask again" saves the full approved command—credentials included—in plain text. Claude Code only adds the file to the user's global git excludes, not the project's .gitignore, so already-committed copies and forks stay exposed; rotate first, then clean up.

Read at thehackernews.com

Claude Code

An AI coding agent for terminal, IDE, web, and Slack

More news

View all

AWS sample runs Claude Code as a remote agent on Bedrock AgentCore, returning PRs

Published Nov 6, AWS's open source sample remote coding agent runs each Claude Code task in its own AgentCore microVM in your account: Opus plans and reviews, Sonnet codes, the repo's own tests verify, with up to three attempts. It opens a pull request (a draft unless verification passed) using 8 hour GitHub tokens, and never merges…

AWS Machine Learning Blog 54 minutes ago

Adobe puts CX Enterprise Coworker inside ChatGPT, Claude, Gemini and Copilot via MCP

Announced Nov 4, Adobe's marketing agent is now a ChatGPT plugin, a Claude connector, and an agent in Gemini Enterprise, Microsoft Copilot, and Databricks Genie, returning read only insights under your existing Adobe permissions after admin approval. Adobe also shipped prebuilt MCP connectors for Amazon Ads, Meta campaigns, Snowflake Cortex AI, Demandbase, and more…

Adobe Newsroom 2 hours ago

Thinking Machines launches Inkling 2 Small, a 594B-A17B MoE with Apache 2.0 weights promised

Announced Nov 5, Inkling 2 Small (594B total, 17B active, text and image input, up to 1M context) is live on Tinker for inference and fine tuning with closed weights for now. Thinking Machines says full Apache 2.0 weights should follow after external safety testing and red teaming…

Thinking Machines Lab 4 hours ago

Baidu releases ERNIE 5.5 Flash Base weights: 280B-A14B MoE base model with 1M context

Released Nov 5, the pre training only checkpoint (33.5T tokens, no instruction tuning) ships in FP8 and BF16 on Hugging Face and ModelScope, serves via SGLang or vLLM with up to 1M token context, and self reports 82.3 on HumanEval+ versus 69.5 for DeepSeek V4 Flash Base. It's under Baidu's own model license, not an OSI license…

Hugging Face (baidu) 5 hours ago

Vercel Schedules public beta runs cron and one-shot tasks on all plans

Announced Nov 5, Vercel Schedules is in public beta on all plans: define recurring or one time jobs in vercel.json (or create them at runtime against a Queue topic), target a private Function, HTTP path, or Queue, and enable/disable/run on demand without redeploying. It succeeds Cron Jobs, which keep working during migration; Hobby includes 5,000 runs per month…

Vercel 6 hours ago

Spotted something we missed? Start a thread.