allegation
After a user selects "是，且不再询问", command text containing secrets may be written into .claude/settings.local.json and then mistakenly committed to repositories.
A allegation by Apiiro. Statements are as reported by the cited publishers — not verified by DecisionGateway.
用户选择“是，且不再询问”后，包含密钥的命令原文可能被写入 .claude/settings.local.json，随后被误提交到仓库
Related claims
More than 100,000 Claude Code local settings files have been uploaded to public GitHub repositories.Apiiro · investigationBecause authentication checks in the Repository commits API are insufficient, a remote unauthenticated attacker can read arbitrary files on the server, including configurations, tokens, keys and credentials.Turan Security xavfsizlik byulleteni · allegationA SGLang vulnerability exposed user account details in a security breach.NEAR AI · allegationAI development should be paused.Democratic congresswoman · commitmentWAF and REST API request logs should be checked.turansecurity · commitmentA critical vulnerability in Keycloak's reset-credentials (CVE-2026-18963, CVSS 9.1) allows any authenticated user, including administrators, to complete a password reset and set a new password.turansecurity · allegation
More claims by Apiiro
The exposure involves 2,539 real credentials across 1,994 code repositories and affects 63 organizations.investigationAbout 1,100 of those files contain database passwords, API tokens, private keys or root login information.investigationMore than 100,000 Claude Code local settings files have been uploaded to public GitHub repositories.investigation
All claims by Apiiro