Clicking “Don’t Ask Again” in Claude Code Put Secrets into a File—and 1,122 Public GitHub Copies Still Hold Them
Apiiro found 1,122 public copies of Claude Code’s local settings file holding passwords, tokens and keys. Removing the file is not enough; rotate first. Here is how the leak happens and what to search for.
A convenience click in an AI coding assistant can turn into a public credential dump. When a developer tells Claude Code “Yes, and don’t ask again,” the tool can save the approved shell command—secrets included—into a project settings file that researchers keep finding on GitHub.
The Hacker News covers research from software security firm Apiiro on the file .claude/settings.local.json and related Claude settings that ended up in public repositories.
How the secret gets saved
- Claude Code asks before running most shell commands.
- If the user chooses “Yes, and don’t ask again,” it writes an allow rule into
.claude/settings.local.jsonin the project. - When the prompt was an exact command (not a pattern), any password or token typed into that command is stored in plain text.
- Claude Code tries to keep the file out of git by adding it to the user’s global git excludes the first time it writes the file—protection that stays on one computer and one user, and does not add the file to the project’s own
.gitignore. - If the file was already committed, or Claude itself co-authored a commit that changed it (Apiiro traced that pattern in 539 of 1,105 repositories), the secret rides into history and forks.
What Apiiro found on public GitHub
- 104,185 copies of the local settings file across 103,617 repositories; about 1.1% (1,122 copies) held at least one secret.
- 1,379 distinct secrets in those current copies; one notified company confirmed its key was still live.
- More than a third of secrets opened a database directly (including 379 database passwords); also 43 SSH logins to public servers, 42 tokens for GitHub/GitLab/npm, and 23 AWS keys.
- 63 organizations among the owners, mostly software companies; strong examples cited include a database vendor’s admin-level cloud key and a medical-records database owner password.
- As of Apiiro’s Monday snapshot, every secret-bearing file was still on the default branch; half had been there at least 217 days.
- Older versions add 734 more secrets across 509 repositories; 211 forks of 74 repos carry the same secrets; shared
.claude/settings.jsonand agent chat logs push the broader total to 2,539 secrets across 1,994 repositories. - Of 16 coding agents whose docs Apiiro compared, Claude Code was the only one confirmed to save the full approved command in a project file by default.
Do this before you clean up
- Search your GitHub organization for
.claude/settings.local.jsonand.claude/settings.json, including git history where the files were deleted. - Rotate first: change every password, token and key those files ever held, then remove tracking and scrub history.
- Add the local file to each project’s
.gitignoreso protection travels with the repo, not only with one laptop. - Treat any secret that sat on a default branch or fork as compromised even if you deleted the current copy.
What this means for your company
AI coding tools are showing up on developer laptops faster than security review can keep up. A “don’t ask again” habit that feels harmless can publish production database passwords and cloud keys to the open internet—and git history will keep them after someone deletes the file. Ban secrets in command lines, require org-wide secret scanning, and make “rotate then scrub” the default response when a settings file full of tokens turns up in a repo.
Need help hunting Claude settings files across your GitHub orgs, rotating exposed keys, and tightening developer workstation policy? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
