Claude Code’s ‘Don’t Ask Again’ Left 1,122 Passwords and Keys Exposed on GitHub

A single click meant to save time has left real passwords and cloud keys sitting in public GitHub repositories. Security researchers at Apiiro found 1,122 public copies of a Claude Code settings file that hold at least one secret, including database passwords, SSH logins, and cloud keys. Reported by The Hacker News on November 7, 2026, the findings show how a convenience feature in an AI coding assistant can quietly turn a typed password into a public leak.

What Apiiro found

Apiiro scanned public GitHub and found 104,185 copies of the file `.claude/settings.local.json` spread across 103,617 repositories. About 1.1 percent of them held at least one secret, for a total of 1,379 distinct secrets.

More than a third of the secrets open a database directly, including 379 database passwords, alongside 43 SSH logins, 42 tokens for GitHub, GitLab, and npm, and 23 AWS keys. Among the owners are 63 organizations, mostly software companies. The strongest cases include a database vendor's own admin-level cloud key and the owner password of a medical-records database.

The picture gets worse with history included. Older versions of the file hold 734 more secrets across 509 repositories, and 211 forks of 74 repositories carry the same secrets as the originals. Secrets also sit in 298 of 76,011 copies of the shared `.claude/settings.json` file, which teams commit on purpose. Counting those files, the older versions, and saved agent chat logs, the total reaches 2,539 secrets across 1,994 repositories.

As of Monday, November 2, every file with a secret was still on its repository's default branch, and in half of those repositories it had been there for at least 217 days. The researchers did not test whether the secrets still work, and they say there is no public evidence that anyone has used them. One company the researchers notified earlier in the week confirmed its key had been live.

How a password ends up in the file

By default, Claude Code asks before it runs most shell commands. If the user picks "Yes, and don't ask again," it saves an allow rule in `.claude/settings.local.json` inside the project. Matching commands then run without asking in later sessions.

The rule covers only what the prompt offered. Sometimes that is a pattern, such as `npm test *`, and sometimes it is one exact command. When it is the exact command, any password or token typed into it is saved too, in plain text. The researchers reproduced the behavior with the latest models, Opus 5.5 and Fable 5.1.

Claude Code does try to keep the file out of git. The first time it writes the file in a git repository, it adds the file to the user's global git excludes, according to its settings documentation. Git on that computer then ignores the file in every repository. That protection stays in one user's git settings on one computer. It does nothing for a file that was already committed, and Claude Code never adds the file to the project's own `.gitignore`, so the protection does not travel with the project. In 539 of the 1,105 repositories traced, a commit listing Claude as a co-author changed the file, which suggests Claude often commits the file itself. A member of the Claude Code team responded on Hacker News, saying the file is meant to stay local and the team is looking into prevention.

Why the usual safety nets missed it

Common secret scanners missed many of these files. The researchers ran gitleaks and TruffleHog over every copy: of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog flagged 643, and neither flagged 215. Most misses are passwords typed inside commands, which look like ordinary words to scanners built to spot known key formats.

Apiiro compared the documentation of 16 coding agents and found Claude Code is the only one confirmed to save the full approved command in a project file by default. Users reported this before: a bug report filed on August 11, 2025 said approved commands with API keys and tokens were being stored word for word, and an automated bot closed it as "not planned" on January 3. The researchers say four related reports have all been closed by the same bot, the most recent one yesterday, with no reply from Anthropic.

What developers should do now

Rotate first: change every password, token, and key the file has ever held, then clean up. Removing the file does not undo the leak, because older versions stay in git history and in forks.

Next, search your GitHub organization for `.claude/settings.local.json` and `.claude/settings.json`, and check each repository's git history for them, even where the files are gone. Stop tracking the local file with git rm --cached .claude/settings.local.json, add it to the repository's own `.gitignore`, and delete every rule that contains a secret from the copy on your own computer.

Going forward, keep secrets out of commands. Refer to them as variables from a secrets manager, such as `$DB_URL`, so the saved rule holds the variable name and not the secret. Approve patterns, such as `Bash(npm run:*)`, instead of single commands. For security teams, the researchers recommend treating agent folders such as `.claude/`, `.cursor/`, `.gemini/`, and `.specstory/` as holding secrets, just like `.env` files, adding those paths to pre-commit and CI secret scanning, and adding `.claude/settings.local.json` to the organization's `.gitignore` templates. Credentials paired with a public server should be checked first, because those are the ones that give access.

Copies that never reach GitHub still matter, the researchers say, since the file can also be left inside an npm package, a Docker image, a zip archive, or a synced folder.

Frequently Asked Questions

What is the Claude Code file that leaked passwords?

The file is `.claude/settings.local.json`, where Claude Code saves allow rules for commands approved with "Yes, and don't ask again." When the approved command was a single exact command with a password or token typed into it, that secret was saved in plain text.

How many secrets did Apiiro find on GitHub?

Apiiro found 1,122 public copies holding at least one secret, for 1,379 distinct secrets. Counting git history, forks, the shared settings file, and saved chat logs, the total reaches 2,539 secrets across 1,994 repositories.

What should I do if I use Claude Code?

Search your GitHub organization for `.claude/settings.local.json` and `.claude/settings.json`, including git history. Rotate every password, token, and key those files have ever held before cleaning up, then stop tracking the local file and add it to `.gitignore`. Use variables from a secrets manager instead of typing secrets into commands.