What happened
According to a review published on security firm Apiiro's blog, the "Don't Ask Again" approval option in Anthropic's coding agent Claude Code is causing secrets to leak into public GitHub files. The Hacker News post, which reached 163 points, states that exposed passwords and credentials were found in 1,122 public GitHub files.
How the problem arises
Coding agents offer a "don't ask again" option so users don't have to approve the same command or file operation repeatedly. Once enabled, the agent can continue actions such as writing files or running commands without user confirmation. The review argues that this convenience creates an opening for sensitive data like secret keys, passwords and tokens to be added to repositories by mistake.
Why it matters
A credential added to a public GitHub repository can be scraped and abused within seconds. Such leaks put not only the developer's own project at risk but also connected cloud services and corporate systems.
Practical advice
- Avoid the "don't ask again" option on sensitive files.
- Enable secret-scanning tools before pushing to a repository.
- Revoke and rotate any leaked keys immediately.
