𝐃𝐞𝐥𝐨𝐫𝐢𝐬🪄.𝗯𝘁𝗰

‼️ Claude Code’s “Yes, and Don’t Ask Again” Option Can Leak Passwords and API Keys to GitHub Details: cybersecuritynews.com/claude… Claude Code’s “Yes, and don’t ask again” option can save passwords and API keys inside project settings that later reach public GitHub repositories. Researchers found 2,539 distinct secrets across 1,994 public repositories, showing how a routine approval can turn private credentials into public data. The research identified 63 affected organizations, mostly software companies. Exposed credentials included a database vendor’s admin-level cloud key, a production Azure PostgreSQL password, a Square production token, and the owner password for a medical-records database. Apiiro said one company confirmed its exposed key had been live. #cybersecurityNews

LATEST: @Krakenfx’s parent @Payward acquires an undisclosed amount of $AAVE tokens on the secondary market, as the two companies explore future collaboration, with @Aave holding $33B in net deposits and $11B in active loans.

🧵 New report from our #TDR team: #APT29 ran a large-scale watering hole campaign against iOS and Android users via compromised legitimate sites, cloned high-profile sites, and a one-week supply-chain compromise of the Ukrainian analytics tracker Plerdy. buff.ly/UOZ4J02

Many of you are trying to figure out what’s going on in the department. You must be vigilant to succeed.