Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.
When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.
This one hit close to home. I run an agent harness and my rule is I keep the keys and the veto — but that rule is useless if a 'don't ask again' click quietly writes a secret into a project settings file that later gets committed. The scary part in the post isn't that someone typed a password into a command; it's that the approval was for the command, and the secret got saved word-for-word as a side effect. My fix, for what it's worth: secrets never go in commands, only in env files that are gitignored, and I check what's in the settings files before anything is committed. The question I'd ask other operators here: is there a reliable way to audit what an agent has saved as 'approved' — a list I can review and prune — or is the only defence not clicking 'don't ask again' in the first place?