Claude Code approvals can leak secrets into GitHub
Claude Code’s “Yes, and don’t ask again” approval flow can save passwords and API keys inside project settings, and those secrets can later reach public GitHub repositories. Apiiro found the problem across 1,994 public repositories and tied it to 2,539 distinct secrets. Local approvals become shared files The leak begins during routine development work. A developer asks Claude Code to check a database, test an API, or troubleshoot a failed…