Claude Code's 'Don't Ask Again' Feature Leaks Secrets in Public Repositories

Passwords and API keys entered into shell commands approved via Anthropic’s Claude Code are exposed in public GitHub repositories. Security firm Apiiro reported on November 6, 2026, that the AI assistant saves these credentials in plain text when users select the "Yes, and don't ask again" option.

What happened

When developers use Claude Code, the assistant requests permission before executing shell commands. If a user chooses to permanently approve a specific command, the tool saves the exact command string, including any embedded secrets, into a local configuration file named .claude/settings.local.json. While the tool attempts to exclude this file from version control by adding it to the user’s global git excludes, it does not add the file to the project’s .gitignore. Consequently, if the file is committed manually or by the agent itself, it becomes part of the repository history.

Apiiro scanned public GitHub repositories and identified 104,185 copies of this settings file across 103,617 repositories. Of these, 1,122 files contained at least one secret, totaling 1,379 unique exposed credentials. The leaked data includes 379 database passwords, 43 SSH login credentials for public servers, 42 tokens for services like GitHub and npm, and 23 AWS keys. Researchers confirmed that one notified company had a live key exposed through this mechanism.

The exposure is persistent because removing the file from the current branch does not erase it from git history or forks. In 539 of the traced repositories, commits listing Claude as a co-author modified the file, suggesting the agent often commits its own configuration changes. Additionally, 298 copies of the shared .claude/settings.json file, which teams intentionally commit, also contained secrets. When including historical versions and agent chat logs, the total number of exposed secrets rises to 2,539 across 1,994 repositories.

How it works

The vulnerability stems from how Claude Code handles command approval. By default, it prompts users before running shell commands. When a user selects "Yes, and don't ask again," the system creates an allow rule in .claude/settings.local.json. This rule matches future commands to avoid repeated prompts. If the approved command is an exact string rather than a pattern, any password or token typed into that command is saved verbatim in the JSON file.

Although Claude Code adds the file to the user’s global git excludes upon first creation in a repository, this protection is local to that specific machine and user. It does not propagate to other collaborators or protect against accidental commits. Furthermore, standard secret scanning tools often miss these leaks. In tests, gitleaks flagged only 564 of the 1,122 exposed files, and TruffleHog flagged 643. Both tools missed 215 files entirely because they look for known key formats, whereas passwords embedded in commands like mysql -p appear as ordinary text.

Key details

• Apiiro found 1,122 public copies of .claude/settings.local.json containing at least one secret.
• The exposed secrets include 379 database passwords, 43 SSH logins, and 23 AWS keys.
• Claude Code is the only coding agent among 16 reviewed confirmed to save full approved commands in project files by default.
• Standard scanners like gitleaks and TruffleHog failed to detect 215 of the exposed secrets.
• Four bug reports regarding this behavior were closed by an automated bot without response from Anthropic.
• Secrets remain accessible in git history and forks even after the file is deleted from the main branch.

Why it matters

For software engineers, this incident highlights a critical gap in the security model of AI coding assistants. Developers often assume that local configuration files are safe from public exposure, especially when tools claim to manage git exclusions. However, the reliance on global git settings means that any collaborator who commits the file, or any mistake in local configuration, can leak sensitive data. The fact that the AI agent itself may commit these files exacerbates the risk, as developers might not review every change made by the assistant.

Security teams must now treat agent-specific folders and memory files with the same scrutiny as .env files. The failure of standard scanning tools to detect passwords embedded in command strings means that existing CI/CD pipelines may provide a false sense of security. Organizations need to update their pre-commit hooks and secret scanning configurations to specifically target these new vectors, ensuring that passwords within commands are flagged alongside traditional API key formats.

What you can do

• Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, including in git history.
• Rotate every password, token, and key that has ever been stored in these files before attempting cleanup.
• Run git rm --cached .claude/settings.local.json and add the file to your repository’s .gitignore.
• Manually inspect the local settings file on your machine and delete any rules containing hardcoded secrets.
• Use environment variables (e.g., $DB_URL) in commands instead of typing secrets directly, so the saved rule references the variable name.
• Approve command patterns (e.g., npm run:*) rather than single exact commands to prevent saving specific arguments.