Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

Anthropic's Claude Code AI assistant has a feature that saves approved shell commands in a project file, including any secrets typed into those commands. This setting, triggered by choosing 'Yes, and don't ask again,' creates a file named .claude/settings.local. that stores the full command, word-for-word.

Security researchers from Apiiro discovered that 1,122 public copies of this file on GitHub hold at least one secret, such as a password or API key. The researchers found that older versions of the file remain in git history and in forks of the repository, meaning simply deleting the file does not undo the leak.

How the Leak Occurs

By default, Claude Code asks before running most shell commands. When a user selects 'Yes, and don't ask again,' it saves an allow rule in the project's .claude/settings.local. file. Matching commands then run without asking in later sessions, but the rule also saves the secret in plain text.

Claude Code attempts to protect the file by adding it to the user's global git excludes on a single computer. However, this protection does not apply to files that were already committed to a repository, nor does it travel with the project, as the file is not added to the project's own .gitignore.

The researchers found that Claude often commits the file itself, as 539 of the 1,105 repositories they traced had a commit listing Claude as a co-author that changed the file. This behavior was reproduced with the latest Claude models, Opus 5.5 and Fable 5.1.

Exposed Credentials

Apiiro's search of public GitHub found 104,185 copies of the file across 103,617 repositories. About 1.1% of these, or 1,122 copies, hold at least one secret, with a total of 1,379 different secrets identified. More than a third of these secrets open a database directly, including 379 database passwords.

The exposed secrets include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab, and npm, and 23 AWS keys. Among the owners of these files are 63 organizations, mostly software companies. The researchers identified a database vendor's own admin-level cloud key and the owner password of a medical-records database as particularly strong cases.

The researchers also found secrets in 298 copies of the shared .claude/settings. file, which teams commit on purpose. Including older versions and saved agent chat logs, the total number of secrets across all file types is 2,539 across 1,994 repositories.

Security Recommendations

For developers, the researchers recommend a specific set of steps to mitigate the risk. They advise searching GitHub for the files, rotating every password, token, and key the files have ever held, and cleaning up by removing the local file from git tracking and adding it to the project's .gitignore.

Security teams should treat agent folders such as .claude/, .cursor/, .gemini/, and .specstory/, as well as agent memory files, as holding secrets like .env files. They should add these folders to pre-commit and CI secret scanning, including git history, and ensure scanners catch passwords inside commands, not only known key formats.

Common secret scanners like gitleaks and TruffleHog miss many of these files. Of the 1,122 files with a secret, neither tool flagged 215. Most misses are passwords typed inside commands, such as PGPASSWORD=, which scanners look for as ordinary words in a command line rather than secrets.

Next Steps

The researchers have notified the affected organizations, with one company confirming its key had been live. The researchers advise that the affected files are still on their repository's default branch in every case, and in half of those repositories the file has been there for at least 217 days.

Copies of the file that never reach GitHub still matter, as the file is plain JSON that can be left inside an npm package, a Docker image, or a zip archive. The researchers emphasize that the next step for affected organizations is to rotate all credentials and adjust their security tools to scan these files.