Claude Code's 'Don't Ask Again' Button Left Passwords and Keys in 1,122 Public GitHub Files
Photo: Hippopx (public domain). Illustrative image.
What happened. Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. Security company Apiiro said in research published on 5 November 2026 that 1,122 public copies of Claude Code’s local settings file hold at least one secret. The cause is an ordinary workflow, not a prompt-injection attack: when Claude Code asks permission to run a Bash command and the user chooses “Yes, and don’t ask again”, the assistant saves that command word for word — including any credential typed into it — as an allow rule in .claude/settings.local.json inside the project folder. If that file is committed and pushed, the secret goes with it, and removing the file later does not undo the leak, because older versions stay in git history and in forks.
What Apiiro found. The researchers collected public GitHub data between 1 and 3 November. They examined 104,185 public copies of settings.local.json in 103,617 repositories and classified 1,122 of them — about 1.1% — as containing secrets, holding 1,379 distinct secret values. A value counted as a secret when it matched a known key format, or when a password or token sat beside the address of a public server. The exposed credentials include a database vendor’s own admin-level cloud key, a production Azure PostgreSQL password, a Square production token and the owner password of a medical-records database. Databases accounted for a large share: 379 database passwords and 122 Supabase service-role keys. Counting older versions of the file, the shared settings.json teams commit on purpose, and saved agent chat transcripts, Apiiro puts the total at 2,539 secrets across 1,994 repositories, affecting 63 organisations, mostly software companies. One company the researchers notified earlier in the week confirmed its key had been live.
Why the usual defences miss it. Claude Code’s own documentation says that the first time it writes the file in a git repository, it adds **/.claude/settings.local.json to the developer’s global git excludes file, so it stays out of commits. Apiiro says that covers the common case but not a folder that becomes a repository later, a clone on another computer, or a file that was already committed — and the rule never goes into the project’s own .gitignore. In 539 of the 1,105 leaking repositories Apiiro traced, a commit co-authored by Claude had changed the file. Generic secret scanners miss many of these too: of the 1,122 files with a real secret, gitleaks flagged 564 and TruffleHog 643, and 215 were flagged by neither — usually because the secret is a password typed inside a command, not a key in a recognisable format. The files have sat exposed for a long time: in the median leaking repository, the file was first committed 217 days before Apiiro’s 2 November snapshot, and as of that Monday every file with a secret was still on its repository’s default branch. Older versions of the file contain 734 more secrets across 509 repositories that are not present in any current copy.
The history. Users have reported the behaviour on Claude Code’s GitHub tracker since August 2025, when a bug report filed on 11 August said approved commands with API keys and tokens were being stored word for word in settings.local.json. Apiiro cites four such reports and says none received a reply from Anthropic; the most recent was closed by an automated bot the day before the research was published. Apiiro says this is “Claude Code’s own behaviour, not the model’s”: it reproduced the saving with the latest models, Opus 5.5 and Fable 5.1, and of 16 coding agents whose documentation it compared, Claude Code was the only one confirmed to write the full approved command to a project file by default. A separate open bug report says approvals are sometimes written to the shared .claude/settings.json instead — a file teams commit deliberately — and Apiiro found secrets in 298 of 76,011 public copies of that file.
What to do. Search your GitHub organisation for .claude/settings.local.json and .claude/settings.json — each hit is a file anyone can read right now. Any credential found in one should be treated as exposed: rotate it, remove the file from the repository, and clean the git history. And keep secrets out of command lines altogether — pass them through environment variables or a secrets manager instead of typing them into a command a coding agent is about to save.
Sources
- The Hacker News — “Claude Code’s ‘Don’t Ask Again’ File Exposes Passwords and Keys in 1,122 Public Copies on GitHub” (6 November 2026): http://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
- Cyber Security News — “Claude Code’s ‘Yes, and Don’t Ask Again’ Option Can Leak Passwords and API Keys to GitHub” (7 November 2026): https://cybersecuritynews.com/claude-codes-yes-and-dont-ask-again/
- MadRobot — “Claude Code ‘Don’t ask again’ left secrets in 1,122 GitHub files” (7 November 2026): https://madrobot.blog/2026/11/07/claude-code-dont-ask-again-secrets-github/
