AI News · 5 min read
Claude Code's 'don't ask again' leaked secrets on GitHub
Apiiro found 1,122 public .claude/settings.local.json files holding secrets saved by Claude Code approvals. Anthropic's reply and the rotate-first fix.
What Apiiro found
Security company Apiiro published research on November 6, 2026, Coding agents leaking secrets on GitHub: "don't ask again" ↗. It shows that one Claude Code approval button has been writing passwords and API keys to disk in plain text. The Hacker News ↗ covered it on November 7.
Here's how it happens. Claude Code asks before it runs most shell commands. If you pick "Yes, and don't ask again," it saves an allow rule to .claude/settings.local.json in the project folder. Sometimes that rule is a pattern like npm test *. Sometimes it is the exact command, and then any password or token you typed into that command is saved too, word for word.
The numbers, as reported by The Hacker News from Apiiro's write-up:
Apiiro found 104,185 public copies of
.claude/settings.local.jsonacross 103,617 repositories.1,122 of those copies (about 1.1%) held at least one secret, 1,379 distinct secrets in total.
More than a third open a database directly, including 379 database passwords. Apiiro also counted 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys.
Counting the shared
.claude/settings.json, older git versions and saved agent logs, the total was 2,539 secrets across 1,994 repositories.In 539 of 1,105 traced repos, a commit listing Claude as co-author changed the file.
Apiiro did not test whether the secrets still worked. One company it notified confirmed its key had been live.
Common scanners missed many of them. gitleaks flagged 564 of the 1,122 files and TruffleHog 643. Neither caught 215, mostly passwords typed inline after things like
PGPASSWORD=ormysql -p.
Apiiro also says it compared the documentation of 16 coding agents. Claude Code was the only one confirmed to save the full approved command in a project file by default.
Anthropic's response
Boris Cherny of the Claude Code team replied in the Hacker News thread ↗:
"Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this."
He also said the file "is meant to stay local," that Claude Code automatically gitignores it when Claude creates the file (so in his view the leaked files "were manually created and checked in"), and that users should move to auto mode and turn on host-side secret scanning. Later in the same thread he said the team is prototyping fixes: "making sure auto mode catches this, building in basic secret scanning, a few other ideas."
There's a catch in the gitignore point. Per Apiiro and Claude Code's own settings docs, the ignore goes into the user's global git excludes on that one machine, not into the repo's .gitignore. So it doesn't travel with the project, and it does nothing for files that were committed before it existed.
What people are saying
The Hacker News' post on X put the scale up front:
"Claude Code's "Don't Ask Again" option can save passwords and API keys in plaintext. Apiiro found 2,539 exposed secrets across 1,994 public GitHub repos, including database credentials, SSH logins, and cloud keys. Deleting files doesn't erase Git history."
Paweł Huryn checked his own machine after Anthropic's reply:
"I checked my Windows laptop. 5 repos with that file, all written by Claude Code between March and August. None ignored. 2 already committed."
He added that today's version does add the global ignore (he tested it), but older files stay unprotected until Claude Code writes them again.
On Hacker News, opinion split. Some blamed users for committing the file. Others blamed the default. One commenter put the middle view this way: "A bit careless but mostly a bad default. One click shouldn't put passwords in files people commit. Anthropic should fix it." (toppa33 on HN ↗)
Our take: who should care
Anyone who has used Claude Code with real credentials should check today. It doesn't matter whether the repo is public. The file is plain JSON in your project folder, and Apiiro points out it can end up in an npm package, a Docker image, a zip or a synced folder.
The fix, in order (from Apiiro's guidance):
Search your repos and their git history for
.claude/settings.local.jsonand.claude/settings.json:git log --all -- .claude/settings.local.json.Rotate first. Change every password, token and key the file ever held before you clean history. Deleting the file doesn't remove it from history or forks.
Untrack it with
git rm --cached .claude/settings.local.jsonand add it to each repo's own.gitignore.Open your local copy and delete any rule that contains a secret.
Going forward, reference secrets as variables (
$DB_URL) from a secrets manager, and approve patterns likeBash(npm run:*)instead of one-off commands.
Our read: this is a sharp edge, not a breach of Anthropic's systems. Still, it's the kind of default that matters more as agents run more of your shell. Claude Code still leads our best AI for coding guide (see also our Claude Code review), and this doesn't change that ranking. It does change how you should set it up. Treat .claude/ (and .cursor/, .gemini/ and similar agent folders) like a .env file. If you're weighing alternatives anyway, see Codex vs Claude Code and cheaper Claude Code alternatives. Whichever agent you pick, keep secrets out of the commands you approve.