Claude Code’s “Don’t Ask Again” Leaked Secrets on GitHub: What Developers Should Do
Disclosure: Bionic Artisan is reader-supported. Some links on this page are affiliate links, which means we may earn a commission if you buy through them, at no extra cost to you. This never changes what we write. Read our full affiliate disclosure. As an Amazon Associate I earn from qualifying purchases.
Note: This article is based on security firm Apiiro’s published research as reported by The Hacker News and other outlets, plus Anthropic’s own Claude Code documentation. We have not reproduced the research ourselves. It is general security information for developers and teams, not legal advice, and it does not show or link to any exposed credentials.
If you use Anthropic’s Claude Code coding assistant, one convenient button may have left a password or API key sitting in a plain text file. Security company Apiiro reported this week that when developers choose “Yes, and don’t ask again” on a shell command, Claude Code can save that exact command, secret included, in a project settings file. Apiiro says it found 1,122 public copies of that file on GitHub holding at least one real secret. Here is what happened, why it matters and the cleanup steps the researchers recommend.
At a glance
- The file:
.claude/settings.local.json, where Claude Code stores “don’t ask again” approvals for a project (per Anthropic’s permissions docs). - The problem: if the approved command contained a password or token, the whole command, secret and all, can be saved in plain text.
- What Apiiro found: 104,185 public copies of the file in 103,617 GitHub repositories; 1,122 copies held at least one secret, 1,379 distinct secrets in total (The Hacker News).
- Not a confirmed breach: Apiiro did not test whether the secrets still work, though one notified company confirmed its key had been live.
- First step if you are affected: rotate (change) every credential the file ever held, then clean up the file and your git history.
What Apiiro found
According to The Hacker News (Nov. 7), Apiiro searched public GitHub and found 104,185 copies of .claude/settings.local.json in 103,617 repositories. About 1.1% of them, or 1,122 files, contained at least one secret, for 1,379 distinct secrets. More than a third of those could open a database directly, including 379 database passwords. Others included 43 SSH logins for public servers, 42 GitHub, GitLab and npm tokens, and 23 AWS keys.
A value counted as a secret only if it matched a known key format, or a password or token appeared next to a public server address, and an AI reviewer also agreed. The researchers said the file owners included 63 organizations, mostly software companies, and that the strongest cases included a database vendor’s admin-level cloud key and the owner password of a medical-records database.
The leak does not end when the file is deleted. Older versions of the file held 734 more secrets across 509 repositories, and 211 forks of 74 repositories carried the same secrets as the originals. Counting git history, the shared .claude/settings.json file and saved agent chat logs, Apiiro put the total at 2,539 secrets across 1,994 repositories. Those wider totals use a different scope from the headline 1,122 files, so the two numbers should not be added together.
Reports differ slightly on the publication date: several outlets date Apiiro’s research to Nov. 5, while The Hacker News, writing on Nov. 7, said Apiiro published it “yesterday.” The exact date is UNVERIFIED here, but the findings were public by Nov. 7.
How a secret ends up in the file
Claude Code normally asks before it runs most shell commands. Anthropic’s permissions documentation says that when you pick “Yes, and don’t ask again” for a Bash command, the approval lasts permanently for that repository and command, and the rule is saved to .claude/settings.local.json at the root of the repository.
Sometimes the saved rule is a pattern, such as npm test *. Sometimes it is one exact command. If that exact command included a database password, a token in a web request header or an SSH password, the secret is saved word for word. Apiiro said it reproduced the behavior with current Claude models, and called it Claude Code’s own behavior, not the model’s.
Claude Code does try to keep the file out of git. Its settings documentation says that the first time it writes the file in a repository that does not already ignore it, it adds **/.claude/settings.local.json to your global git excludes file. Apiiro’s point is that this protection lives on one computer, in one user’s git settings. It does not help on another machine or container, for a file created by hand, or for a file that was already committed, and the rule is not added to the project’s own .gitignore. In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file.
Why common scanners missed some of it
Apiiro ran two popular open-source secret scanners, gitleaks and TruffleHog, over the 1,122 files. Gitleaks flagged 564 and TruffleHog 643, and 215 files were flagged by neither. Most misses were passwords typed inside commands, which look like ordinary words to tools that hunt for known key formats.
What to do if you use Claude Code
These are the steps Apiiro recommended, as reported by The Hacker News:
- Search your GitHub organization for
.claude/settings.local.jsonand.claude/settings.json, including git history where the files have since been deleted. - Rotate first. Change every password, token and key the files have ever held before you clean anything up, because old copies can live on in history and forks.
- Untrack the local file with
git rm --cached .claude/settings.local.jsonand add it to the repository’s own.gitignore. - Check your own computer. Open the file locally, even if it was never committed, and delete any rule that contains a secret.
- Keep secrets out of commands. Refer to them as environment variables from a secrets manager, such as
$DB_URL, so a saved rule stores the variable name, not the value. - Approve patterns, not one-off commands, such as
Bash(npm run:*).
For security teams, the researchers suggested treating AI agent folders such as .claude/, .cursor/ and .gemini/ like .env files, adding them to pre-commit and CI secret scanning (including history), and adding the local settings file to organization-wide .gitignore templates.
What Anthropic has said
The Hacker News reported that an earlier Claude Code bug report describing the same behavior was filed in August 2025 and later closed automatically as “not planned” after inactivity, and that the four related reports the researchers cited were all closed by the same bot without a reply from Anthropic. As of Monday morning, Nov. 9, we did not find a public Anthropic statement responding to Apiiro’s research, so whether a product change is planned is UNVERIFIED. Anthropic’s documentation does say to add the file to .gitignore yourself if you create it by hand.
This comes during a busy stretch for Anthropic. We recently covered its IPO filing and its Claude Personal Finance feature, and earlier this month OpenAI introduced a restricted cybersecurity model. As AI agents get permission to run commands and touch real accounts, where they store those permissions becomes a security question in its own right.
Related reading
If you write or review code and want a plain-English grounding in secure development, including why secrets should never be hard-coded, Tanya Janca’s Alice and Bob Learn Application Security (view on Amazon) is a widely used introduction to application security. It is a general book, not specific to Claude Code. Check the current price on Amazon.
Related reading: OpenAI’s GPT-6 Cyber: What the New “Critical” Cybersecurity Model Means, and Claude Personal Finance: What Happens When You Connect Your Bank to Claude.
Our take
This is not a hack of Anthropic, and it is not proof that anyone has used these keys. It is a reminder that convenience features in AI coding tools write things to disk, and that a protection which only lives on one laptop does not travel with a project. If you have ever clicked “don’t ask again” on a command that contained a password, assume it was saved, rotate it, and move secrets into environment variables. The fix is boring, and that is the point.
Sources: The Hacker News (Nov. 7, 2026) reporting on Apiiro’s research; Anthropic Claude Code permissions and settings documentation, checked Nov. 9, 2026. Google Trends’ U.S. daily search RSS loaded on Nov. 9 but contained no AI topics, so this topic was picked from the week’s top AI security news. Times are Eastern Time (ET). Images are AI-generated illustrations.
