Claude Code's 'Don't Ask Again' Exposed Secrets on GitHub

How one approval becomes a stored secret

Claude Code asks before it runs most shell commands. Ask it to check a staging database or call an internal API and the command it proposes often carries the credential from your config, written out in full. Choosing the standing approval runs the command and saves it as an allow rule in .claude/settings.local.json inside the project, so the same command never prompts again. Anthropic's own settings documentation describes both halves of this: the approval is saved to that file, and the first time the file is written inside a git repository, Claude Code adds it to the developer's global git excludes so it stays out of commits.

That protection is narrower than it sounds. It lives in one person's git configuration on one machine. It never enters the project's own .gitignore, so it does not travel with the repository, and it does nothing for a file that was already committed before the excludes entry existed, or committed from a different machine or clone.

Apiiro examined commit histories for 1,105 affected repositories and reported that 539 had changes to the settings file in commits listing Claude as a co-author. That association raises questions about agent-assisted commit workflows, but the co-author marker alone does not establish that Claude independently staged or committed the exposed file.

The result is durable. Every leaking file was still on its repository's default branch at the snapshot, the median file had been there 217 days, and deleting the file today would not end the exposure: older versions hold 734 further secrets across 509 repositories, and 211 forks carry copies of the same material.

What the count does and does not show

Apiiro counted a value as a secret when it matched a known provider key format, or when a password or token sat next to the address of a public host, with an AI reviewer also agreeing on masked candidates. It did not try any credential, contact any host, or check whether a key had been revoked. The 2,539 figure counts distinct values classified as exposed secrets across the researchers' expanded dataset, including current settings files, repository history, shared settings and agent logs. It does not mean 2,539 working credentials or 2,539 compromised systems. Apiiro did not test whether the credentials remained valid, although one notified organization confirmed that an exposed key had been live. The researchers do not say whether anyone else has used them.

Two details keep the finding from reading as a rounding error. First, the mix: database passwords are the largest single group, and a credential paired with a public server address is the combination that gives an outsider a direct route in. Second, the scanner gap. Passwords typed inside commands, after a flag or an environment assignment on the same line, do not look like keys to tools built to recognize key formats. In this test, approximately one in five affected files was missed by both scanners. The result illustrates a detection gap for credential-bearing command text, but does not establish how either tool would perform with different rules or configurations. A repository can have secret scanning switched on and still hold this file.

Apiiro says it reviewed documentation for 16 coding agents and identified Claude Code as the only one in that comparison with confirmed default behavior that persists the full approved command in a project settings file. That finding is limited to the products and documentation examined; it does not establish that other agents cannot expose credentials through different mechanisms. Users first reported it in August 2025. The four tracker reports the research cites have since been closed by an automated bot without a recorded reply from Anthropic, and no fix appears in the reporting read for this piece.

The check, in the order the researchers give it

Search public repositories, current settings files and Git history for `.claude/settings.local.json` and `.claude/settings.json`, including repositories where those files have since been deleted. Treat exposed credentials as compromised until assessed: revoke or rotate them promptly, prioritizing production credentials and those associated with internet-accessible services. Do not wait for repository cleanup before disabling exposed access.

Next, remove credential-bearing allow rules from local settings. Stop tracking accidentally committed local settings files and add appropriate ignore rules to the repository's `.gitignore`. Remember that `.gitignore` does not untrack files already in Git. Removing a file from the current branch also leaves historical commits and forks to address. Where appropriate, follow GitHub's sensitive-data removal guidance, coordinate history rewriting with collaborators, and understand that copies already fetched by others cannot be reliably recalled.

Avoid placing literal passwords or tokens in commands that Claude Code may save as standing approvals. Prefer approved secret-management mechanisms that supply credentials at execution time without exposing their values in the command text or model-visible context. Review saved permission rules before reuse. Broader command-pattern approvals may reduce literal-secret persistence, but they can also expand what Claude Code is permitted to execute; use them only where the scope is understood and appropriately constrained.

Sources

[1] Apiiro research, Shmulik Cohen and Matan Giladi, 5 November 2026: the 'Don't Ask Again' findings — 104,185 public copies of .claude/settings.local.json, 1,122 holding at least one secret, and 2,539 distinct secrets across 1,994 repositories in the expanded count. Every figure in this article is Apiiro's, as reported.Read source
[2] The Hacker News, "Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub", 7 November 2026: full report of the Apiiro write-up, read in full for this article — the mechanism, the scanner counts, the co-author commit trace and the remediation order.Read source
[3] Anthropic, Claude Code settings documentation: choosing "Yes, and don't ask again" saves the approval to .claude/settings.local.json, and the file is added to the developer's global git excludes on first write inside a repository.Read source
[4] MadRobot, "Claude Code 'Don't ask again' left secrets in 1,122 GitHub files", 7 November 2026: independent summary cross-checked against the figures above.Read source

THE ALFW VERDICT

This exposure does not require an attacker to break Claude Code or persuade a model to ignore its instructions. A standing approval can preserve a credential-bearing command in plain text, and an ordinary Git commit can turn that local convenience into a public secret. Apiiro's 2,539 reported secrets are not 2,539 verified working credentials, and the researchers did not establish how many were exploited. The more actionable finding is the detection gap: in Apiiro's test, both Gitleaks and TruffleHog missed 215 of the 1,122 affected files. Teams using Claude Code should treat saved permission rules as potentially sensitive configuration, inspect their repository histories and rotate exposed credentials before attempting cleanup. A passing secret scan is useful evidence, not proof that this exposure never occurred.