Claude Code's "don't ask again" put 1,379 secrets on GitHub: check your repos
When you approve a command in Claude Code with "Yes, and don't ask again", the exact command goes into .claude/settings.local.json, password included. Apiiro searched public GitHub and found 1,122 of these files with a real secret in them. Here's how to check yours and what to do if one is there.
What happened
Security firm Apiiro published research on November 5, 2026 showing how Claude Code's permission prompt leaks credentials. Ask it to query a database or call an API and the command it proposes can carry the password or token from your config. Pick "Yes, and don't ask again" and Claude Code saves that exact command, secret and all, as an allow rule in .claude/settings.local.json inside the project.
The file is meant to stay on your machine. When Claude Code creates it inside a git repo, it adds it to your global git ignore list, which lives on that one machine, Apiiro found. A file created before the folder became a repo, a clone on another computer and a copy someone already committed aren't covered. In 539 of the 1,105 repos where Apiiro traced a leaking file, a commit co-authored by Claude had changed it.
What Apiiro found
Apiiro counted 104,185 public copies of the file in 103,617 repos. Of those, 1,122 (1.1%) held a real secret: 1,379 distinct ones, and 379 of them database passwords. Another 734 secrets sat only in git history, in 509 repos where someone had deleted the file but never rewrote the git history. Add the shared settings file, agent transcripts and memory files, and it comes to 2,539 secrets in 1,994 repos.
Big allowlists leak most: one file in ten over 8 KB held a secret, against fewer than one in 500 under 500 bytes. Generic scanners missed a lot of it. Gitleaks flagged only 564 of the 1,122 files and TruffleHog 643: a password typed after PGPASSWORD= or sshpass -p looks like an ordinary word to a scanner tuned to key formats. Apiiro didn't test whether any credential still works.
What Anthropic said
Boris Cherny, who leads Claude Code at Anthropic, replied on Hacker News on November 7, according to Apiiro's November 8 update. It quotes him saying the team is "looking into what we can do to prevent this", with auto mode catching it and basic secret scanning among the options. As of that update, no fix had shipped.
Check your repos
Search your GitHub account or organisation for both files: .claude/settings.local.json and the shared .claude/settings.json. Then, inside each local repo, see whether the file is tracked now or was ever committed:
git ls-files .claude/settings.local.json
git log --all --oneline -- .claude/settings.local.jsonAny output means it's in the repo's history, and in every fork and clone made since.
Fix it
- Rotate first. Change every password, key and token the file has ever held.
- Stop tracking it and ignore it in the repo itself, so the rule travels with the code:
git rm --cached .claude/settings.local.json echo ".claude/settings.local.json" >> .gitignore - Clean the allow list on your machine even if the file was never committed: delete every rule with a secret in it.
- Keep secrets out of commands. Reference them as variables, so the saved rule reads
$DB_URL, not the password. Approve patterns such asBash(npm run:*)for repeat commands.
If you publish npm packages or build Docker images, add .claude/ to .npmignore and .dockerignore as well. A Claude Code hook can block a command that carries a secret before it runs.
Try it
Read .claude/settings.local.json and .claude/settings.json in this repo, if they exist. List every allow rule that contains something that looks like a secret: a password, token, API key, private key or connection string with credentials. For each one, show the rule with the secret masked (first 4 characters, then ****), say what service it opens, and propose a replacement rule that uses an environment variable or a command pattern instead. Don't edit any file and don't print a secret in full. Then tell me whether either file is tracked by git.
Write a git pre-commit hook in [bash / Python] that blocks a commit when: - .claude/settings.local.json is staged, or - any staged file under .claude/, .cursor/, .gemini/ or .specstory/ contains PGPASSWORD=, sshpass -p, mysql -p, "Authorization: Bearer" or a string that looks like an API key. Print which file and line triggered it, with the value masked. Keep it under 60 lines, no dependencies, and tell me how to install it in one command.
Sources
- Apiiro, Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub, November 5, 2026, updated November 8
- Cloud Security Alliance, research note on the settings-file leak, November 8, 2026