HU
Idea log · Thursday, November 12, 2026

Leaked keys in Claude Code's permission file

Based on 14 newsletters · 8 to try · 4 to watch · 5 in brief
Today's most important item is K1: if you have ever approved a Claude Code command containing a password or key with "Don't ask again", that key may be sitting verbatim in a project file, and from there it can end up on GitHub.

🛠 Ideas to try

Claude Code: keys in .claude/settings.local.json

urgent check

When you approve a Bash command with "Don't ask again", Claude Code saves the command verbatim in an allow in the project's .claude/settings.local.json file. If the command contained a password or key, that gets saved too. The file is meant to stay local, but it can end up in : if it was created by hand, added with git add -f, or was already a tracked file. Apiiro's research found 1,379 real secrets (database passwords, SSH logins, tokens) in 1,122 public GitHub files, and 2,539 with a broader search. Secret scanners missed some of the files. The sources differ on the numbers: the newsletter says 1,122 files, other articles say 1,379 or 2,539 secrets; these are different measurements.

  • Check run this in every project: git ls-files | grep settings.local.json and git log --all --oneline -- .claude/settings.local.json, then look in the file for Bash(...) rules containing a password, a -p flag or a token.
  • Fix first rotate every key and password that ever appeared in the file, because deleting it doesn't invalidate copies already out there. Then: git rm --cached .claude/settings.local.json, add it to .gitignore, and delete the rules containing secrets.
  • GrantGuard Vanta's open-source tool reviews Claude Code's "always allow" rules and flags risky ones (hardcoded keys, rm -rf, git push *). Run: ; to include project folders, add the --scan flag. It only reads, and deletes only after confirmation. github.com/OpenVanta/GrantGuard
Sources: The Code Cybersecurity · apidog.com/blog/claude-code-dont-ask-again-api-key-leak/
For you: If you use Claude Code, run K1a in every project folder, especially where you worked with database or SSH passwords.
For you: From now on, pass passwords as environment variables (e.g. $DB_PASS), so the approved rule stores only the variable name, not the password itself.

Weekly security updates: Git, Chrome, Outlook

  • Git 2.56.1 because of , a malicious repository can run code on your machine during a recursive clone (--recursive, with submodules). Fixed in 2.56.1, and in 2.55.1, 2.54.1 etc. On a Mac: git --version, then update with Homebrew (brew upgrade git) or by updating the Xcode Command Line Tools. GitHub Desktop ships its own Git, which must be updated separately. Source: The Code Cybersecurity · github.blog/open-source/git/git-security-vulnerabilities-announced-7/
  • Chrome the eighth actively exploited this year (in the XML parser). Update and restart the browser. Source: TLDR InfoSec
  • Outlook (CVE-2026-124194) opening a malicious message file leaks the Windows login credential (), which an attacker can use to log in as the user. The flaw is already being exploited. Important: the fix comes with the Office update, not the Windows update. Source: The Code Cybersecurity, WSJ Pro (1,094 fixes on November's )
For you: Do K2a on your own development machine and your servers (git --version). If your company or organization has Windows PCs, check K2c there: in Office, under File / Account / Update Options.

An "audit" command for new models and Addy Osmani's 10 tips

  • Re-check with a new model an Anthropic engineer runs this on his projects whenever a new model ships: /model (switch to the latest), then the prompt: "Read this entire project and find everything that's broken, inconsistent, inefficient, or no longer needed. Fix what you're sure about and list the rest for me to review." Saved to .claude/commands/audit.md, it can then be called with /audit. Source: The Code
  • Work with the agent like a lead the key points from Addy Osmani's 10: (1) give the agent a way to verify (tests, screenshots); (2) write down what isn't visible in the code (goal, constraints, when it's done); (3) if you fix the same mistake twice, put it in CLAUDE.md; (4) if it still goes the wrong way after two fixes, start a new session with a better prompt; (5) before an unattended run, define what counts as done and who approves it. Source: The Code
For you: If you build with Claude Code, save the audit prompt as an /audit command and run it on your existing projects now. It pairs well with the Fable 5.2 prompting guide in Nov 13 / K4; and make point (3) of K3b a daily habit.

A decision model instead of an LLM: Amazon labels 44 times cheaper

In an internal ticketing system, Amazon replaced Claude Sonnet 4.6 with its own Strands Decider model, which doesn't generate text but gives probabilities for predefined labels. Accuracy stayed the same, while cost per ticket dropped from $0.022 to $0.0005 and response time from 4.2 s to 0.9 s. The lessons: write each label as a 1–2 sentence criterion, include a "none of these" option, and run the old and new solutions in parallel for a while. The model has a small context (4,096 ), gives no explanatory text, and must run on your own server (GPU).

Source: The Code · strandsagents.com/blog/amazon-saves-millions-replacing-sonnet-with-str
For you: If you want to label emails, newsletters or tickets with AI (e.g. promo / worth watching / questionable), write the labels as 1–2 sentence criteria with a "none of these" option. Without your own GPU, the cloud-based Gemini Decisions (Nov 13 / K2) is probably an easier starting point.

A two-step "more human text" prompt for articles

The open-source STE80 Humanizer skill fixes AI-sounding text in two passes. First it removes 26 typical AI phrasings, then it rewrites sentences into short, active constructions, one idea per sentence. You can try it without installing anything with this prompt (it works in other languages too): "Rewrite this draft in plain language. Keep every fact, number, name and source claim. Use the active voice where it's accurate; keep one main idea per sentence; replace abstract phrases with concrete actors and actions; delete repeated conclusions and filler transitions. Don't add new facts, jokes or confidence. At the end, list the three sentences that still carry too many ideas." Then read it aloud and restore the style where it became too sterile. For fiction and ad copy, only the first pass is recommended.

Source: The Neuron · github.com/Dodaios/ste80-humanizer
For you: If you write local news or sports articles from AI drafts, run the prompt above on a finished draft. Together with the "declauding" skill from Nov 13 / K7, one removes the phrasings and the other fixes the sentence structure.

HA-MCP: controlling Home Assistant with Claude

An open-source server through which Claude can create and fix automations, scripts and dashboards in Home Assistant, and also analyze logs. It provides about 87 tools; unlike the built-in HA server, it can access everything, not just the tools exposed to Assist. Install from or the Marketplace (Home Assistant 2026.8+). For Claude Code there is an install script with a --claude-code flag. Security: create a separate admin account for it that is reachable only from the local network. Adding /readonly to the end of the URL makes it read-only, and approval can be required for write operations.

Source: TLDR DevOps · github.com/homeassistant-ai/ha-mcp
For you: If Home Assistant ties together your smart home devices, start in /readonly mode (e.g. "why did the light turn on at night?"). Remote access should go through a VPN (e.g. WireGuard), not a public secret URL.

A free full usage limit reset in Claude (until Dec 10)

Because bugs made usage limits drain faster than they should, every paid (Pro, Max, Ultra, Team) user gets one free, full limit reset for all models. It can be redeemed until 2:00 PM PT on Dec 10 (11:00 PM Central European Time); the interface also shows the exact expiry time.

Source: Claude Code Daily · x.com/ClaudeDevs/status/2120275296637321476
For you: If you have a paid Claude plan, save the reset for a big development or writing day when you would otherwise run out.

Inspected installs instead of curl | sh (installctl)

installctl runs "copy and run" install scripts in an isolated layer, then lists which files they created, modified or deleted, and you decide what to apply. It stops and asks when a script installs packages, creates a new user, or changes systemctl or crontab, and at the end it writes an uninstall script. Note: it uses , so it is for Linux and doesn't run on a Mac.

Source: TLDR InfoSec · github.com/yamixst/installctl
For you: If you run a Linux server or VPS, it's useful before running a third-party install script. On a Mac instead: download the script first, have Claude read through it, and only then run it.

👀 Worth watching / ❓ Raises questions

AI keys are hackers' new prize

Besides Railway, about a dozen AI developer platforms were breached in a month, mainly for customers' keys. In the Railway case, the WSJ reports at least $750,000 and The Code about $740,000 in unauthorized AI charges. By combing through leaked source code with AI agents, the attacker found a second way in within hours. Lesson: put a monthly spending cap on AI provider keys and give them only the permissions they need. (WSJ Pro Cybersecurity, The Code Cybersecurity)

Keep admin panels off the internet

Flaws in the Barracuda email gateway and N-able N-central (33 zero-days in the latter) can be exploited because the admin console is reachable from the internet. The question for any smaller setup: are your router's management interface, WordPress /wp-admin and your servers' admin panels reachable only via VPN? (TLDR InfoSec)

Gemini turned on by default in Gmail

In Google Workspace, thread summaries and "Help me write" are switched on by default for every user aged 18+, with the rollout running for 15 days from Nov 10. Organizations handling health or other sensitive data should decide whether they want it on for such emails, since admins can turn it off. (TLDR IT)

Apple "Harbor": the Mac as a private AI server

Apple's subsidiary Claris is testing an app that turns Apple Silicon Macs into a local AI server, even pooling the memory of several Macs over Thunderbolt 5. It is in early access for now, with no announced price. Worth keeping in mind when replacing a small office server. (TLDR)

📰 In brief

Anthropic introduced Claude Sheets, Whiteboards and Data (formerly Dashboards) on paid plans, and Claude Meetings in beta for Team/Enterprise customers; Apps can also embed a full web page in Claude. (TechCrunch, TLDR AI, Superhuman, The Neuron, Claude Code Daily)
Gemini 4 Carbon, Google's most capable model, is out: $2 / $10 per million input/output tokens until Nov 30, after which The Neuron says the price doubles; the TLDR newsletters call it an "introductory price" without mentioning the doubling. (TLDR AI, TLDR Dev, TLDR, Superhuman, The Neuron)
Anthropic's : 825M shares in a $70–78 range, under the ticker ANT on Nasdaq; per the WSJ, that's a valuation of about $1.3 trillion. (TLDR AI, TLDR, The Neuron, TechCrunch)
Jensen Huang (Nvidia) admitted an affair with a suspected Chinese intelligence agent; the board opened an investigation and Congress is seeking a hearing. (TLDR InfoSec, TechCrunch ×2)
Amazon Ring announced a $250 indoor drone camera (from Jan 27, pending FCC approval) and a $1,000 patrolling robot (from Dec 16). (TLDR, The Neuron)

Based on 14 newsletters, summarized with the help of AI. Items are short summaries in our own words; follow the links for details.

🔎 Search and filter across all days