Claude Code’s ‘don’t ask again’ left passwords in 1,122 public GitHub files

Anthropic’s Claude Code asks for permission before it runs most shell commands, and one of the answers on offer is “Yes, and don’t ask again.” Pick it for a command that contains a password, such as a database login, and Claude Code can write the whole command, password included, into a plain-text settings file inside your project. Security researchers have now found thousands of those passwords and keys sitting in public code repositories on GitHub, where anyone can read them.

If you use Claude Code, the file to look for is called settings.local.json. It lives in a hidden .claude folder at the root of the repository, and it goes wherever the project goes unless you stop it. The behavior is the same in every country where the tool is available. Changing your habits takes a minute, while cleaning up a leaked password takes far longer, because deleting the file does not delete it from git history or from other people’s forks.

Software security company Apiiro searched public GitHub and found 104,185 copies of the file in 103,617 repositories, according to its research as reported by The Hacker News. About 1.1%, or 1,122 copies, hold at least one secret, for a total of 1,379 different credentials. More than a third would open a database directly, including 379 database passwords. The haul also includes 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 Amazon Web Services keys.

The owners are not only hobbyists. Apiiro traced the files to 63 organizations, mostly software companies of all sizes, and its worst examples include a database vendor’s own admin-level cloud key and the owner password of a medical-records database. Older versions of the file in git history hold 734 more secrets across 509 repositories, and 211 forks of 74 repositories carry the same secrets as the originals. Add the shared settings file that teams commit on purpose and saved agent chat logs, and the count climbs to 2,539 secrets across 1,994 repositories.

Claude Code does try to keep the file out of version control. Anthropic’s settings documentation says that the first time the tool writes the file, it adds a rule to the user’s global git excludes, so git ignores it on that computer. That rule never travels with the project to a teammate’s laptop, a build server or a fresh machine, and it does nothing for a file that was already committed. In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as co-author changed the file, which suggests the agent often commits it itself. Of 16 coding agents whose documentation Apiiro compared, Claude Code is the only one confirmed to save the full approved command in a project file by default.

The usual safety nets miss a lot of it. Apiiro ran two popular open-source secret scanners, gitleaks and TruffleHog, over every copy: gitleaks flagged 564 of the 1,122 files, TruffleHog flagged 643, and 215 slipped past both. Most of the misses were passwords typed after PGPASSWORD=, sshpass -p or mysql -p, which look like ordinary words to a tool hunting for known key formats.

The findings come with caveats. Apiiro sells security tools for AI-assisted development, so the research doubles as a sales pitch. It did not test whether the credentials still work, although one company it notified confirmed that its key had been live. A value counted as a secret when it matched a known key format, or when it sat beside a public server address and an AI reviewer agreed, which leaves some room for false positives. Apiiro also says the co-author figure does not prove Claude introduced every exposed credential. And GitHub is only the visible part: the file is plain JSON in the project folder, so it can also ride along in an npm package, a Docker image, a zip archive or a synced folder.

The researchers’ first piece of advice is to rotate: change every password, token and key the file has ever held before cleaning anything up, because a secret that has been public is burned whether or not you rewrite history. Then stop tracking the file with git rm –cached, add it to the repository’s own .gitignore, and open /permissions inside Claude Code to delete any saved rule that contains a secret. Referring to credentials through environment variables means a saved rule stores a name such as $DB_URL instead of the password, and approving patterns rather than one-off commands keeps literal arguments out of the file altogether.

Users flagged this before. A bug report filed on August 11, 2025, said approved commands with API keys and tokens were being stored word for word in settings.local.json, and an automated bot closed it as “not planned” on January 3 after 60 days without activity. Apiiro, which published its findings on November 6, says the four related reports it cites were all closed by the same bot, the latest one on November 6, without a reply from Anthropic. As of November 2, every exposed file it found was still on its repository’s main branch, in half the cases for at least 217 days.

Neither The Hacker News nor Apiiro reports a response from Anthropic, and the documented behavior is unchanged: the next “don’t ask again” on a command with a password typed into it will save that password too.

Tags: Cybersecurity, Anthropic, Claude Code, GitHub, AI coding tools, Apiiro