Claude Code's 'Don't Ask Again' Button Left 1,379 Passwords and Keys Sitting in Public GitHub Repos

A convenience button in Anthropic's coding agent has been quietly publishing database passwords. Researchers at the security firm Apiiro found 1,122 public copies of a Claude Code settings file on GitHub that hold at least one secret, 1,379 distinct secrets in total, from 63 organizations.

The culprit is the "Yes, and don't ask again" option. When a developer approves a shell command that way, Claude Code saves an allow rule in .claude/settings.local.json inside the project. Sometimes the rule is a pattern like npm test *. Sometimes it is the exact command, and if that command had a password or token typed into it, the secret goes into the file in plain text.

How a local file ends up public

The file is meant to stay on the developer's machine. Claude Code adds it to the user's global git excludes, but not to the repository's own .gitignore. Clone the project onto another computer, or turn a folder into a repo after the file exists, and the protection is gone. Apiiro says Claude Code often commits changes to the file itself.

Searching public GitHub in early November, the researchers counted 104,185 copies of the file across 103,617 repositories. About 1.1% held a secret. More than a third of those open a database directly, including 379 database passwords. The haul also includes 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, 23 AWS keys and 122 Supabase service role keys. Counting git history, shared settings files and committed agent transcripts, the total rises to 2,539 secrets in 1,994 repositories.

Scanners missed a lot of it

Standard tools would not have saved most teams. Of the roughly 1,100 secrets in the current files, 215 slipped past both gitleaks and TruffleHog, because a password after sshpass -p or PGPASSWORD= reads like any other word on a command line.

Apiiro did not try any of the credentials, so this is an exposure count, not a confirmed breach. One company it notified did confirm its key had been active. Anthropic told Ars Technica it recommends secret scanners and is considering building scanning into Claude Code.

What to do now

Deleting the file does not undo anything, because old versions live on in git history and in forks. The order matters:

• Search your repos and their history for .claude/settings.local.json and .claude/settings.json.
• Rotate every password, token and key those files ever held.
• Untrack the file with git rm --cached .claude/settings.local.json and add it to the repo's .gitignore.
• Open your local copy and delete any rule that contains a secret.
• Keep secrets out of commands by referencing variables like $DB_URL, and approve patterns instead of single commands.

The same habits help with the wider problem of secrets piling up on developer laptops, where infostealers now go after the credential files of AI coding tools too.

Some offers on this page may be paid placements or contain affiliate links.