Marius’s Lemmy
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
not_IO@lemmy.blahaj.zone to Technology@lemmy.worldEnglish · 9 hours ago

Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

thehackernews.com

external-link
message-square
8
link
fedilink
183
external-link

Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

thehackernews.com

not_IO@lemmy.blahaj.zone to Technology@lemmy.worldEnglish · 9 hours ago
message-square
8
link
fedilink
Claude Code saves secrets in approved commands, exposing 2,539 credentials across 1,994 public GitHub repositories, Apiiro finds.
alert-triangle
You must log in or register to comment.
  • UltraBlack@lemmy.world
    link
    fedilink
    English
    arrow-up
    60
    ·
    9 hours ago

    What the fuck is this website?

    Are they ripping off HN and AI summarising their posts our what

    • Pomal@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      9
      ·
      6 hours ago

      This is what I thought people referenced for over a decade whenever they mentioned HN because no one pointed me to the actual HN.

      • not_IO@lemmy.blahaj.zoneOP
        link
        fedilink
        English
        arrow-up
        10
        ·
        4 hours ago

        y combinator was founded by sam altman and is really mostly AI schill and very boring nowadays

        • Pomal@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 hours ago

          That explains why LLMs are so stochastic.

    • whyNotSquirrel@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      17
      ·
      7 hours ago

      https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again

      is this the original?

  • Dr. Wesker@lemmy.sdf.org
    link
    fedilink
    English
    arrow-up
    64
    arrow-down
    1
    ·
    9 hours ago

    Devs accidentally committing secrets and forgetting to gitignore env files is nothing new, this is just a new surface. It’s why secret scanning is such an important part of a CI/CD pipeline.

    • dominos_project_3@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      7 hours ago

      a high entrop for any data going out from that blind CLI should be banned without exception. The user then needs to approve. its the responsibility of Anthropic.

    • DevDave@piefed.social
      link
      fedilink
      English
      arrow-up
      3
      ·
      8 hours ago

      it’s a bit tedious in some ways but I really liked working with GitHubs secret system. As long as you ensure nothing changes in the GitHub run system you could use various key signing mechanisms or even uploads to service providers like AWS with out sharing via dot files or user configuration only files that end up being committed to the repo.

Technology@lemmy.world

technology@lemmy.world

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@lemmy.world

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


  • @L4s@lemmy.world
  • @autotldr@lemmings.world
  • @PipedLinkBot@feddit.rocks
  • @wikibot@lemmy.world
Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 5.47K users / day
  • 10.3K users / week
  • 15.5K users / month
  • 30.3K users / 6 months
  • 1 local subscriber
  • 89.6K subscribers
  • 22.6K Posts
  • 792K Comments
  • Modlog
  • mods:
  • L3s@lemmy.world
  • enu@lemmy.world
  • Technopagan@lemmy.world
  • L4sBot@lemmy.worldB
  • L3s@hackingne.ws
  • UI: unknown version
  • BE: 0.19.21
  • Modlog
  • Legal
  • Instances
  • Docs
  • Code
  • join-lemmy.org