AI agents are leaking secrets into public repos
A scan found passwords and keys in 1,122 public GitHub files tied to Claude Code. The mechanism is the "Don't Ask Again" permission, which writes the approved command, secrets included, into .claude/settings.local.json. Developers then commit the .claude folder. One commenter pointed out the headline is confusing, since the scan covers repos where people committed that folder. Others complained the write-up was padded and repeated itself, which looked like unedited AI output.
The bug is simple. The tool saves the literal command string, and humans paste credentials into commands. The fix is as dull as .gitignore, but nobody thinks about a new dotfile until it burns them.
The nuance: this is a user mistake at heart. The tool still shipped a default that makes the mistake easy.
So what?
If you ship an agent or CLI that persists user actions, treat the saved files as sensitive by default. Redact secrets before storing them and ship a .gitignore entry. If your team uses these tools, add a pre-commit secret scan that covers agent config folders.