Claude Code's "Yes, and Don't Ask Again" Option Can Leak Passwords and API Keys to GitHub - CyberSecurityNews

The leak begins during ordinary development work when a developer asks Claude Code to check a database, test an API, or troubleshoot a failed login.

Claude prepares a shell command containing a credential from a configuration file, then asks for permission before running it.

Choosing 'Yes, and don’t ask again' can store that command, including its secret, in .claude/settings.local..

The command becomes an allow rule, letting Claude Code run it again without another prompt. The danger comes when that local file is committed and pushed to GitHub.

Apiiro’s research examined 104,185 public copies of .claude/settings.local.. Researchers found real secrets in 1,122 files, holding 1,379 distinct credentials.

Checking earlier commits, shared settings, and agent transcripts brought the total to 2,539. Collection took place November 1–3, 2026.

Exposed credentials included a database vendor’s admin-level cloud key, a production Azure PostgreSQL password, a Square production token, and the owner password for a medical-records database.

Apiiro said one company confirmed its exposed key had been live.

The distinction matters. This exposure does not require a malicious prompt or a stolen account. It follows a normal approval flow.

Earlier Claude Code configuration vulnerabilities involved attackers changing project settings to steal API keys, but this finding concerns secrets recorded during legitimate work.

Local Approvals Become Public Secrets

Claude Code does try to prevent this. When it first writes the file inside a Git repository, it adds an exclusion to the developer’s global Git ignore file.

However, that protection does not travel with the project, cover files already tracked, or reliably protect a folder turned into a repository later.

Apiiro found that databases accounted for a large share of exposed access, including 379 database passwords and 122 Supabase service-role keys.

Other findings included cloud credentials, private keys, package-registry tokens, and 43 SSH logins. Some SSH commands contained root passwords.

Standard scanning did not catch everything. Of the 1,122 affected local settings files, Gitleaks flagged 564 and TruffleHog flagged 643.

Neither tool flagged 215 files. Passwords embedded after PGPASSWORD= , sshpass -p , or inside request headers often lack the clear formats used to recognize provider-issued keys.

Keeping these files off GitHub also leaves a local risk. Malware can read plaintext settings on compromised laptops.

The Shai-Hulud npm supply-chain attack already demonstrated how attackers use TruffleHog to search developer files for credentials. That history makes agent approval files a practical target, not just a publishing mistake.

Developers should search current files and Git history for .claude/settings.local. and inspect shared .claude/settings. files.

Review allow rules for passwords, tokens, connection strings, and authorization headers. Apiiro also found secrets in saved agent conversations, memory files, and deployment notes.

The first response is rotation, not deletion. Revoke exposed credentials before removing files or rewriting history.

Untrack local settings with git rm --cached .claude/settings.local. and add the path to the repository’s .gitignore .