build1 publisher
Claude Code merged a cloned repo's settings.json before it asked whether you trust the directory
Two CVEs describe a startup window where a repository's own config file set the CLI's base URL and hooks while the trust prompt was still pending. On Linux, the key that leaks shares a plaintext file with GitHub and AWS tokens.
Publishers:dev.to
Reality
- Evidence22
- Adoption
- Insufficient
- Hype gap+45
- Incentives70
- Confidence32