SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Claude Code's saved approvals exposed secrets in 1,122 public GitHub repositories

0
·6 views

Security firm Apiiro scanned 104,185 copies of Claude Code's local permission files across public GitHub repositories and found 1,122 containing at least one secret, 1,379 distinct secrets in total. When users pick "Yes, and don't ask again," the approved command, including any inline password, is saved as a permanent allow rule in .claude/settings.local.json. Two common secret scanners, gitleaks and TruffleHog, together missed 215 of the affected files. Claude Code's default protection is a global git excludes entry, which does not travel with a project to other machines, and in many cases the agent itself committed the file. The exposed credentials include database passwords, SSH logins, GitHub, GitLab and npm tokens, and AWS keys.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Corvusmem gives AI coding agents persistent local memory across sessions

AI coding agents often forget project context between sessions, forcing developers to re-explain details every day. Corvusmem is a new open-source tool that gives agents such as Claude Code or Codex a persistent memory stored as a plain file within the user's repository. The tool runs fully locally with no server, cloud, API key, or telemetry, and uses deterministic recall without embeddings or vector databases. It supports multilingual keys and values and can share memory across team members while keeping each author's facts separate. The project is free for non-commercial use under the PolyForm Noncommercial license, with a separate commercial license available.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Passing MCP Unit Tests Doesn't Mean AI Agents Won't Break Your Server in Production

A DEV Community article argues that MCP servers, which let language models connect to tools like Prometheus, Grafana, and Loki, can pass every unit test yet still fail when driven by an AI agent. Unit tests assume a predictable caller that picks the right tool, supplies clean arguments, and calls once, while real agents may hesitate between similar tools, retry aggressively under load, and misread empty results as failures. The piece proposes a two-tier evaluation rubric, where Tier 1 checks protocol and handler correctness and Tier 2 checks behavior under an agent, with a score below 5 out of 6 on either tier signaling the tool is not production-ready. It highlights schema drift between JSON contracts and handler code as one example of a Tier 1 failure that can halt incident triage. The author adapts the framework specifically for incident response, where the gap between correct server behavior and agent behavior can be costly.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Corvusmem gives AI coding agents local, persistent memory across sessions

AI coding agents typically start each day without context about a project, forcing developers to repeat details like their tech stack and coding rules. Corvusmem is a new tool that gives agents such as Claude Code and Codex a persistent memory stored as a plain file within the user's repository. It runs entirely locally with no server, cloud, API key, or telemetry, and uses deterministic recall without embeddings or a vector database. The tool is installed via npm, supports teams with per-author memory that merges cleanly, and caps the amount of memory injected per message to keep context windows small. It is open and free for non-commercial use under the PolyForm Noncommercial license, with a separate commercial license available.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

facebook-skills: ให้ Coding Agent ช่วยงานเพจได้แค่ไหน และอะไรยังต้องคุมเอง

ถ้า Claude Code หรือ Codex อ่านคู่มือทำคอนเทนต์เป็นชุด รู้ว่าควรเขียนโพสต์แบบไหน ต้องขอข้อมูลอะไร และเมื่อไรควรหยุดให้คนตรวจ เราจะเรียกสิ่งนี้ว่า “AI ดูแลเพจ” ได้เลยหรือเปล่า? คำตอบขึ้นอยู่กับว่า “ดูแล” หมายถึงช่วยเตรียมงาน หรือมีสิทธิ์ลงมือทำแทนเราจริง ๆ เพราะสองอย่างนี้ไม่ใช่เรื่องเดียวกัน โพสต์ของ Thongchai Thampueak ที่นำมาเป็นจุดตั้งต้น แนะนำ facebook-skills ว่าเป็นชุดทักษะให้ Claude Code และ Codex ช่วยงาน Facebook Page ตั้งแต่คิดเนื้อหาไปจนถึงเตรียมเผยแพร่ ส่วนตัวโครงการคือ sergebulaev/facebook-skills โดย Sergey Bulaev / Creative Content Crafts ตาม LICENSE จึงควรแยกผู้แชร์เรื่องนี้ออกจาก

0 comments Read more at DEV Community