Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files

When you are building quickly with AI coding assistants like Claude Code, it is tempting to click through safety prompts so the tool can run commands on its own. However, security researchers at Apiiro recently discovered over a thousand public GitHub files containing exposed secrets tied to auto-approved agent workflows.

Automating your AI agent means giving it permission to create, edit, and push files without asking you every time. If you keep API keys, database passwords, or secret tokens in your project folder, the assistant might commit and publish those sensitive details online before you even notice.

To stay safe, always keep your credentials inside environment variable files that are ignored by your version control system. Taking an extra second to review what your AI tool is uploading saves you from having to revoke leaked keys later.

Community discussion: https://news.ycombinator.com/item?id=50407882