A quiet weekend window for vendor releases. Today's lead is a catch-up from late in the previous window that spread widely overnight.

Top line

Catch-up: Claude Code's "don't ask again" file is leaking secrets to public GitHub repos

When a user picks "Yes, and don't ask again," Claude Code can save the approved command word for word in .claude/settings.local.json, including any password or token typed into it. Per security firm Apiiro, as reported by The Hacker News on Nov. 7, 1,122 of about 104,000 public copies of that file hold at least one secret (1,379 in total, including 379 database passwords, 43 SSH logins and 23 AWS keys). Counting git history, the shared settings.json and agent chat logs, the total rises to 2,539 secrets across 1,994 repositories. Claude Code adds the file to the user's global git excludes, not the project's .gitignore, so the protection doesn't travel with the repo, and common scanners missed many entries. Apiiro didn't test whether the secrets still work, though one notified company confirmed its key had been live. Anthropic had not responded publicly as of the report; treat this as unconfirmed by the vendor.

Why it matters: Deleting the file doesn't undo the exposure, because old versions stay in git history and forks. Teams using Claude Code should rotate any secret that ever appeared in these files before cleaning up.

Sources: The Hacker News report · Apiiro research

Codex lead: every Pro tier drops the 5-hour limit, with 10X to 50X Plus usage

OpenAI's Codex lead Thibault Sottiaux posted late Saturday (11:09 p.m. CT) that all Pro plans have no 5-hour limits and give, compared with Plus, 10X usage on Pro 100, 20X on Pro 200, and 50X plus Ultrafast access on Pro 500. He framed it as clearing up confusion, not a new change, and it fills in the baseline missing from his earlier "50X" remark. He didn't say whether the multiples cover Codex only or all ChatGPT usage, and we didn't find the figures in OpenAI's help articles yet. A follow-up asking whether a "Pro 50" would make sense was a poll, not an announcement.

Why it matters: Teams sizing seats for heavy Codex use can compare tiers against Plus directly. Confirm against your own usage meter before buying, since the documentation hasn't caught up.

Sources: Tibo's post

What to do

  • Audit Claude Code repos now. Search for .claude/settings.local.json and .claude/settings.json (including git history), rotate any secrets found, run git rm --cached .claude/settings.local.json, add it to each repo's .gitignore, and approve patterns instead of exact commands. The Hacker News report
  • Expect pull_request_target failures Monday, 10 a.m. to noon CT. GitHub temporarily enforces its new default block on public repos Nov. 9 and Nov. 16 before permanent enforcement Dec. 2; check Insights and allow workflows that need it. GitHub changelog
  • Catch-up: move off 24 Workers AI models before Nov. 20. Cloudflare will return HTTP 410 for models including DeepSeek V4 Pro/Flash, Kimi K2.6/K2.7-code, GLM-5.2, QwQ-32B and Llama 3.2 1B/3B. Cloudflare changelog
  • Vertex users pinned to gemini-3.6-flash: Google's model-versions page lists retirement Nov. 19, with gemini-3.8-flash as the replacement. Google Cloud model versions
  • Keep patching KEV items: CISA's due dates are Nov. 18 for Apple WebKit CVE-2024-27834 and Nov. 20 for SonicWall CVE-2026-19868. CISA KEV

Also notable

  • Catch-up, China: MIIT's binding notice on agent-equipped devices requires per-device validation, a unique agent ID, fraud-risk assessment, MIIT review before over-the-air agent upgrades, and developer consent before agents call apps. MIIT notice
  • GitHub: unauthenticated API requests saw elevated timeouts from 4:36 to 5:56 a.m. CT Sunday. GitHub status
  • OpenAI billing: the Nov. 6 decline issue for some U.S. business Mastercards is still marked monitoring; prepaid API users should keep a backup card. OpenAI status
  • Watch: Thinking Machines says Inkling 2 Small (594B total, 17B active) weights should follow under Apache 2.0 "next week"; Hy4 full weights, the Pentagon AI-lab legal inventory and GitHub's Nov. 5 Actions root-cause report are still unpublished. Inkling 2 Small

Sources

The Hacker News report · Apiiro research · Tibo's post · GitHub changelog · Cloudflare changelog · Google Cloud model versions · CISA KEV · MIIT notice · GitHub status · OpenAI status · Inkling 2 Small