Last week, editing a client script, I stopped clicking “Allow All”
I was helping a small studio update an automated quoting script. A prompt appeared: “Allow this type of action from now on?” I clicked Allow without thinking. The tool then wrote a client password from my local environment into the code and pushed it to a public repository. Only then did it hit me: skipping one confirmation can also mean skipping the safety check.
This Isn’t Unique to One Tool
Reporting found that 1,122 public GitHub files could contain passwords or other sensitive information after people used Claude Code’s “Don’t Ask Again” option. Lin Hao, a programming enthusiast in Hangzhou, also encountered a tool automatically reading local configuration while debugging a deployment script, then incorporating that content into the code. Claude Code isn’t the only tool at risk: any assistant that can read files, modify code, and connect to a code repository could run into the same problem.
I used to get stuck here too. I thought “public repository” only meant the code was public. I didn’t realize environment variables, password files, and auto-generated configuration could end up there as well. Now I first search the project for passwords, tokens, and client data, then inspect the commit history. Even if I delete the current file, old commits may still retain the content.
Replicating This Check Today Costs Little
Money: 0 yuan. Time: about 30 minutes. Technical barrier: I need to open a project folder, copy a URL, and search for text when prompted—no programming knowledge required. First step: open Claude Code’s permission settings, find “Don’t Ask Again” or related automatic-approval options, and switch them to ask every time. Then open the GitHub project page, click “Code,” search for terms such as password, secret, and token, and check the commit history.
Not everyone needs this tool. If I’m only using AI to rewrite copy or make images, and it never touches client files or code repositories, I can leave it alone for now. There’s no urgent need to try it; but once a tool can access project files, I’d rather spend a few extra minutes confirming what it does.
What I Do at Each Stage
Just starting: If I’m only using AI for copy or images, I won’t touch “auto-allow.” I keep project files separate from chat histories.
With one or two clients: If client data enters a project, I have the assistant ask for permission every time, and I search the code and commit history once a month. I move sensitive information into a dedicated password manager.
Scaling up: When multiple projects run automatically, I limit permissions to specific directories, disable automatic pushes, and require a human review of a new team member’s first action. Here too, I’m not trying to solve everything at once. I start by confirming every action that could push something to a public repository.
What worries you more: a password becoming public, or client data being committed by mistake? I’m also curious about the backup safeguards you use.