Claude Code's 'Don't Ask Again' Left Passwords in 1,122 Public GitHub Files, Apiiro Says; Anthropic Says It Is Looking at Fixes
Security firm Apiiro says Claude Code can save an approved shell command word for word, including any password or token in it, to .claude/settings.local.json when a user picks 'Yes, and don't ask again.' It found 1,122 public GitHub copies of that file holding 1,379 distinct secrets, and says common scanners missed some. Claude Code's Boris Cherny said on Hacker News the team is looking into prevention, Ars Technica reported on November 9. Apiiro did not test whether the secrets still work.
The leak comes from a convenience feature, not a bug in the model. When a developer tells Claude Code to stop asking about a command, the approval can be saved exactly as typed, password included, in a file that Claude Code only keeps out of git on the developer's own computer.
What Apiiro found#
When a user selects "Yes, and don't ask again," Claude Code saves an allow rule in .claude/settings.local.json inside the project, The Hacker News reported, citing Apiiro's research and Claude Code's documentation. Sometimes the rule is a pattern; sometimes it is the exact command, including any secret typed into it, in plain text.
Claude Code adds the file to the user's global git excludes the first time it writes it, but not to the project's own .gitignore, so the protection does not travel with the repository. Apiiro searched public GitHub and found 104,185 copies of the file in 103,617 repositories. About 1.1% of them, 1,122 copies, held at least one secret, totalling 1,379 distinct secrets, according to The Hacker News. More than a third open a database directly, including 379 database passwords; others include 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys. Apiiro counted 63 organisations among the owners.
Counting older versions in git history, the shared .claude/settings.json file and saved agent chat logs, Apiiro puts the total at 2,539 secrets across 1,994 repositories. Of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog 643, and neither flagged 215, mostly passwords typed inside commands.
Who committed the files#
Apiiro and Anthropic describe the cause differently. Apiiro found that in 539 of the 1,105 repositories it traced, a commit listing Claude as co-author changed the file, which it takes to mean Claude often commits the file itself. Boris Cherny of Claude Code wrote on Hacker News that the files should almost never be checked in and that the cases seemed to come up when "the files were manually created and checked in," Ars Technica reported. He said the team is "looking into what we can do to prevent this" and is considering building secret scanning into Claude Code.
The behaviour was reported before. A bug report filed on August 11, 2025 said approved commands with API keys were being stored word for word, and an automated bot closed it as "not planned" after 60 days without activity, according to The Hacker News.
Ars Technica pointed to a related case last month, when Meta paused Muse chat sharing after researchers found share links that were easy to discover.
What Apiiro recommends#
Apiiro's advice is to rotate first: change every password, token and key the file has ever held, then remove it from tracking, add it to the repository's .gitignore, and check git history and forks, since deleted copies persist there. It also recommends approving command patterns rather than single commands, and referring to secrets as environment variables so the saved rule holds a variable name.
Limits#
- Apiiro did not test whether the secrets still work; The Hacker News says one notified company confirmed its key had been live.
- Apiiro published its research on November 6; this brief is based on The Hacker News and Ars Technica accounts of it, and we did not read Apiiro's write-up directly.
- Anthropic's response comes from a Hacker News comment reported by Ars Technica; we did not see a formal Anthropic statement or a fix.