AI Assistants Leak Secrets via Saved Settings

When coding assistants save user‑approved commands to per‑project settings files, those files can be (and have been) committed into git repositories and forked, exposing passwords, API tokens, and keys in public history even after deletion. The leak persists in git history and forks, so the safe remediation sequence is rotate secrets first, then purge history and forks. — Shows an emergent class of supply‑chain and cloud‑credential risks driven by AI developer tools that requires both vendor fixes (agent behavior, default ignores, secret scrubbing) and operational policy changes (mandatory secret scanning, automated rotation and git‑history remediation).