Protecting API keys and secrets
Leaked keys, hijacked accounts, and how to lock secrets away.
- Thursday, November 12, 2026 · K1 Claude Code: keys in .claude/settings.local.json
When you approve a Bash command with "Don't ask again", Claude Code saves the command verbatim in an allow rule in the project's .claude/settings.local.json file. If the command contained a password…
- Thursday, November 12, 2026 · F1 AI keys are hackers' new prize
Besides Railway, about a dozen AI developer platforms were breached in a month, mainly for customers' API keys. In the Railway case, the WSJ reports at least $750,000 and The Code about $740,000 in…
- Friday, November 13, 2026 · F3 Leaked API keys → a $740,000 AI bill
Intruders at the Railway cloud host stole environment variables, mainly AI provider keys, and used them to run up charges. Grok Build's 35,000 public apps also exposed confidential data. Lesson: put…
- Friday, November 13, 2026 · K6 GitHub security: 4,837 hijacked accounts and locking GitHub Actions
If you have code on GitHub, you can check for the signs above in five minutes (especially commits after Nov 10). If you deploy your website with GitHub Actions, K6b is worth doing too.
- Saturday, November 14, 2026 · K5 The campaign against GitHub accounts is bigger than thought (Update: see Nov 13 / K6)
According to fresh data from Aikido, attackers used 4,837 compromised accounts to open "test" PRs in 61,764 repositories, and the malware actually ran in at least 1,835 of them. Besides GitHub…