Claude Code's “don’t ask again” left passwords in 1,122 public GitHub files

Security researchers at Apiiro reported on 5 November 2026 that clicking “Yes, and don’t ask again” in Anthropic’s Claude Code can save a password or API key, word for word, into a project file that later ends up on public GitHub. The Hacker News and Cyber Security News both covered the findings on 7 November 2026.

Apiiro searched public GitHub between 1 and 3 November 2026 and found 104,185 copies of .claude/settings.local.json across 103,617 repositories. Of those copies, 1,122 — about 1.1% — held at least one “real secret”: a value matching a known key format, or a password or token sitting next to a public host. Together those files held 1,379 distinct secrets. Counting older versions of the file, the shared .claude/settings.json that teams commit on purpose, and saved agent chat logs, Apiiro put the total at 2,539 distinct secrets across 1,994 repositories (Apiiro, The Hacker News).

The company did not test whether any secret still worked, and it did not contact the hosts. In its method note, “real secret” means a credential that passed its detectors and an independent review, not one proven to be valid (Apiiro). One organisation the researchers notified on 2 or 3 November confirmed that its exposed key had been live (Apiiro, The Hacker News).

How a secret lands in the file

By default, Claude Code asks before it runs most shell commands. Anthropic’s settings documentation says that choosing “Yes, and don’t ask again” on a permission prompt writes a standing approval as an allow rule in .claude/settings.local.json inside the project.

The rule is the command string itself. If the command Claude proposed already carried a database password or an API token, that secret is saved in plain text with the approval (Apiiro, The Hacker News). Apiiro says this is Claude Code’s own behaviour, not a quirk of one model: the researchers reproduced it with Anthropic’s Opus 5.5 and Fable 5.1 (Apiiro).

Of 16 coding agents whose documentation they compared, Claude Code was the only one confirmed to write the full approved command to a project file by default (Apiiro).

A protection that does not travel with the project

The file is meant to stay on one machine. Anthropic’s docs say that the first time Claude Code writes it in a git repository, it adds **/.claude/settings.local.json to the developer’s global git excludes, so the file stays out of commits on that computer. If someone creates the file by hand, they are told to add it to .gitignore themselves (settings documentation).

Apiiro’s point is that this protection lives in one user’s git settings on one computer. It does not go into the project’s own .gitignore, so it does not follow the project to another clone, cover a folder that becomes a repository later, or help a file that was already committed (Apiiro, settings documentation).

In 539 of the 1,105 repositories with a secret that the researchers traced, a commit listing Claude as a co-author had changed the file. They take this to mean Claude often commits the file itself (Apiiro, The Hacker News).

What was exposed

Apiiro says 63 organisations hold a real secret in a public allow list, mostly software companies of all sizes. The strongest cases it describes, each checked at a pinned commit, include a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records app’s database (Apiiro).

More than a third of the secrets in the current local-settings files open a database directly, including 379 database passwords and 122 Supabase service-role keys. The same files also held 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, 23 AWS keys and 6 private keys (Apiiro).

Every one of the 1,122 files with a secret still sat on its repository’s default branch on 2 November 2026. In the median repository, the file had first been committed 217 days earlier (Apiiro). Deleting it is not enough: older versions in git history held another 734 secrets across 509 repositories that no longer appear in any current copy, and 211 forks of 74 repositories carried the same secrets (Apiiro).

Teams also commit the shared .claude/settings.json on purpose. Apiiro found secrets in 298 of 76,011 public copies of that file, mostly inside allow rules (Apiiro).

Why scanners miss many of them

The researchers ran gitleaks and TruffleHog over all 104,185 local-settings files, without the tools’ verification step. Of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog flagged 643; 215 were flagged by neither. The usual miss, they say, is a password typed after a database or SSH password flag, or inside a request header — an ordinary word in an ordinary command, not a key in a recognisable format (Apiiro, The Hacker News). Most of these files never reach GitHub: they sit as plain JSON on the developer’s machine, and can also leave in a published package, a Docker image, a zip archive or a synced folder (Apiiro).

Users reported it earlier

Claude Code users have described the same mechanism on GitHub since August 2025. Apiiro cites four reports, including issue #5544, which said approved bash commands containing credentials were stored as-is in settings.local.json. The researchers say none of those four reports received a reply from Anthropic, and that three were closed automatically as inactive or duplicates (Apiiro, The Hacker News). As of 7 November 2026, The Hacker News likewise reported no response from Anthropic on those issues.

What the researchers recommend

Apiiro’s advice to anyone who uses Claude Code is to search their GitHub organisation — and each repository’s git history — for .claude/settings.local.json and .claude/settings.json. If a file holds a credential, rotate that password, token or key first. Removing the file does not clear git history, forks or other people’s clones (Apiiro).

They also recommend untracking the local file and adding it to the project’s own .gitignore, deleting any allow rule that still contains a secret on the local machine, referring to secrets as variables instead of typing them into commands, and approving command patterns rather than one exact command (Apiiro, The Hacker News). For security teams, they suggest treating agent folders such as .claude/, .cursor/, .gemini/ and .specstory/ as secret-bearing, like .env files, on laptops as well as in repositories (Apiiro).

Why it matters

Coding agents now sit in the middle of everyday work: checking a staging database, calling an API, running a migration. A convenience click meant to skip a repeated prompt can write the full command — secret included — into a file that is easy to publish. The gap Anthropic documents (a global ignore on one machine, not a project .gitignore) and the counts Apiiro published show how often that file has already left the laptop. The practical response is the one the researchers emphasise: look for the file, rotate anything it has ever held, and stop putting secrets in the commands an agent is allowed to remember.