ого какую крутую аналитику в кодекс завезли, можно посмотреть какой тред сколько скушал (и на какой модели мы гоняли его)

[high] Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets When a Claude Code user picks "Yes, and don't ask again" on a shell command, Claude Code can save the exact command, including any password or token typed into it, as an allow rule in .claude/settings.local.json in the project. Claude Code adds that file to the user's global git excludes on one machine, but never to the project's own .gitignore, and does nothing for a file that is already tracked. Apiiro researchers Shmulik Cohen and Matan Giladi published research on Nov 5 2026 that found 104,185 public copies of the file on GitHub, 1,122 of them (about 1.1%) holding at least one secret, 1,379 distinct secrets in total, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys. Counting git history, the shared .claude/settings.json and saved agent chat logs, they counted 2,539 secrets across 1,994 repositories. Apiiro did not test the credentials, but one notified company confirmed its key had been live. Earlier bug reports about the behavior were closed by an automated bot without a reply from Anthropic. Status: live · Patch: unpatched Latest updates: ● 2026-11-07: The Hacker News covers the research; the four related Claude Code bug reports the researchers cite have all been closed by a bot with no reply from Anthropic. (source) ● 2026-11-05: Apiiro publishes the research: 1,122 of 104,185 public .claude/settings.local.json copies hold secrets, 2,539 secrets across 1,994 repositories overall; gitleaks and TruffleHog together missed 215 of the files with secrets. (source) ● 2026-11-03: Apiiro finishes collecting public GitHub data (Nov 1 to 3) and notifies affected organisations on Nov 2 and 3; one company confirms its exposed key had been live. (source) via pwn.watch: Anthropic incident updates

https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026