Claude Code's "Don't Ask Again" approvals left passwords and keys in public GitHub repos

Security firm Apiiro found that Claude Code, Anthropic's AI coding agent, saves commands that developers approve with "Yes, and don't ask again" word for word — including any password or token typed into them — in a project file that often ends up in public GitHub repositories. Teams that use Claude Code should search their repositories for .claude/settings.local.json, rotate any secret it has ever held, and then remove the file from git. There is no CVE and no reported exploitation, and as of November 8, 2026 Anthropic had not commented publicly.

What happened, in plain English

Claude Code is an AI assistant that works inside a developer's project: it reads code, edits files and runs terminal commands. Before it runs most commands, it stops and asks the developer for permission. One of the answers is "Yes, and don't ask again", which saves an "allow rule" so the same command runs without a prompt next time.

Anthropic's documentation confirms that these rules are stored in a file called .claude/settings.local.json at the root of the project. The rule can be a pattern, such as "any npm test command", or one exact command. The problem is the exact command. If a developer approved something like a database login with the password written inline, the password is saved in that file in plain text.

Claude Code tries to keep this file out of git: the first time it writes the file, it adds it to the developer's personal "global git excludes" list. But that list lives only on one laptop. It does not travel with the project, it does not protect a teammate's machine, and it does nothing if the file was already committed.

In research published on November 5, 2026, Apiiro (researchers Shmulik Cohen and Matan Giladi) searched public GitHub and, according to Apiiro as reported by The Hacker News, found 104,185 copies of the file in 103,617 repositories, 1,122 of them containing at least one secret — 1,379 distinct secrets in total, including 379 database passwords, 23 AWS keys and 42 GitHub, GitLab or npm tokens.

Think of it as a sticky note with your PIN on it, placed inside a notebook that you then photocopy for anyone who asks.

Are you affected? What to do now

You are potentially affected if anyone in your organization uses Claude Code (terminal, IDE extensions or desktop app) on a git repository — especially a public one, or a private one that is shared widely, packaged, or published as a Docker image or npm package. Cloud sessions are less exposed: Anthropic's documentation says .claude/settings.local.json is not read in cloud sessions and stays on the developer's machine. If nobody in your organization uses Claude Code, you have nothing to do for this specific issue, though the same check is worth running for other agent folders (see the last item).

Checklist, in order:

• Find the files. Search your GitHub or GitLab organization for .claude/settings.local.json and .claude/settings.json, including git history and forks — not only the default branch. Apiiro reports 734 further secrets in older versions of the file across 509 repositories, and secrets copied into 211 forks.
• Read the permissions.allow entries. Look for passwords and tokens inside commands — for example after PGPASSWORD=, sshpass -p, mysql -p, Authorization: headers or API key parameters.
• Rotate first, clean up second. Treat every secret that has ever appeared in the file as exposed. Change passwords and revoke keys before you rewrite history; deleting the file does not un-leak anything already cloned or scraped.
• Stop tracking the file. Remove it from the index with git (git rm --cached .claude/settings.local.json) and add it to the project's own .gitignore, so the protection travels with the repository. Add it to your organization's .gitignore templates too.
• Clean local copies. On developer machines, delete any allow rule that contains a secret, even if the file was never committed.
• Change the habit. Approve patterns (for example Bash(npm run *)) rather than one-off commands, and pass secrets through environment variables or a secrets manager instead of typing them into commands.
• Fix your scanners. Apiiro reports that of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog 643, and neither flagged 215 — mostly because a password typed inside a command looks like an ordinary word. Add agent folders (.claude/, .cursor/, .gemini/, .specstory/) to pre-commit and CI secret scanning, and prioritize credentials that sit next to a public server address.

No official indicators of compromise have been published.

The expert view

The root cause is a design decision, not a memory-safety bug: the permission system persists the literal approved command string as the rule, and a literal command string can contain credentials. That turns a convenience feature into a credential store with no encryption, no redaction and no expiry. Anthropic's permissions documentation describes Bash approvals as saved "permanently per repository and command"; nothing in the documentation suggests the string is sanitized.

The defensive layer that is supposed to stop the leak — adding the file to the user's global git excludes — is a per-machine control applied to a per-repository artifact. It fails in three common cases: the file was committed before the exclude existed, a teammate or CI runner never got the exclude, or the file leaves through a channel git ignores (an npm tarball, a Docker build context, a zip, a synced folder). Apiiro also reports that in 539 of 1,105 traced repositories, the commit that changed the file listed Claude as co-author, suggesting the agent itself often stages and commits it.

The issue is not new. A GitHub bug report filed on August 11, 2025 (anthropics/claude-code #5544) describes exactly this behavior — approved commands with credentials stored as-is in settings.local.json — and asks for redaction. It was closed as "not planned" by an automated stale-issue bot on January 3, 2026, without a reply from Anthropic staff. According to Apiiro, four related reports were closed the same way. Of 16 coding agents whose documentation Apiiro compared, Claude Code was the only one confirmed to save the full approved command in a project file by default.

Severity in context: there is no CVE or CVSS score, and none is likely, because the software works as documented. Real-world impact depends on whether the leaked secrets still work, which Apiiro does not know for most of them; one notified company confirmed its key "had been live." The numbers are modest next to the overall volume of secrets leaked on GitHub, but the population is high-value — database passwords and SSH logins for public servers grant direct access — and the leak is invisible to developers who trust that Claude Code "keeps it out of git." Commodity credential-harvesting malware such as the 2025 Shai-Hulud npm worm already runs secret scanners over infected machines, so local copies matter too.

The broader trend: AI agents are accumulating state — permission rules, memory files, chat transcripts — in dot-folders inside repositories, and security tooling has not caught up. Those folders should be treated like .env files. Microsoft's recent report on AI agents searching GitHub for leaked cloud keys shows how quickly such leaks are found.

Still unknown: whether Anthropic will change the default (for example, redacting secrets or refusing exact-match rules for commands that contain them), how many of the leaked secrets were valid, and whether anyone has abused them. Apiiro does not say that any were used.

Official sources

• Apiiro research (Shmulik Cohen, Matan Giladi, November 5, 2026): https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
• Anthropic — Claude Code docs, Configure permissions ("Yes, and don't ask again" behavior): https://code.claude.com/docs/en/permissions
• Anthropic — Claude Code docs, Settings files (.claude/settings.local.json, global git excludes): https://code.claude.com/docs/en/settings
• GitHub issue anthropics/claude-code #5544 (August 11, 2025): https://github.com/anthropics/claude-code/issues/5544
• Coverage: The Hacker News, November 7, 2026 — https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html