Claude Code's Don't Ask Again Option Exposed Secrets on Public GitHub

How an approval prompt becomes a stored password

Claude Code asks permission before running a shell command, and one of the answers is "Yes, and don't ask again." Anthropic's documentation says that choice saves the approval as an allow rule in .claude/settings.local.json. The rule can hold the complete command that was approved. If that command had a database password or an API token typed into it, the credential is now sitting in a plaintext file inside the project.

The file is meant to be personal. Anthropic describes it as settings for one user in one project, and says Claude Code adds the path to the user's global git excludes the first time it writes the file in a repository that does not already ignore it. That protection lives on one machine, however. The project's own .gitignore is not changed, so it does not travel with the repository to another computer or collaborator. Once the file is committed and pushed to a public repository, every credential in it goes along.

What Apiiro counted on public GitHub

Researchers Shmulik Cohen and Matan Giladi at the security firm Apiiro published the findings on 5 November. Using public GitHub data collected from 1 to 3 November, they examined 104,185 public copies of the settings file. They classed 1,122 copies, about 1.1%, as containing secrets, holding 1,379 distinct values.

A broader search that also covered Git history, shared settings, and agent transcripts raised the count to 2,539 distinct secrets across 1,994 repositories. The two figures measure different things, which explains why headlines about the study quote different numbers.

Reported categories include 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab, and npm, and 23 AWS keys. Exposure was not brief: in half of the affected repositories, the file stayed on the default branch for at least 217 days.

There is an important limit on these numbers. Apiiro classified candidates by format and context, using false-positive filters and an LLM reviewer on masked values, and it did not try the credentials. Some may be expired or inactive. Apiiro notified affected organizations on 2 and 3 November, and one company confirmed that its exposed key was live.

Why this was already a known bug

The behavior was reported publicly more than a year ago. A GitHub issue opened in August 2025 described approved Bash commands being stored with plain text credentials in the same file. A bot closed it as not planned in January 2026 after 60 days of inactivity, and the thread shows no comment from an Anthropic maintainer. We found no public Anthropic statement or product change responding to Apiiro's research in the sources we reviewed.

Apiiro also compared documentation for 16 coding agents and reported that Claude Code was the only one confirmed to save the full approved command in a project file by default. That claim rests on documentation rather than testing of each tool, so it is best read as a comparison of stated behavior.

What developers should do now

Search your repositories, including history, for .claude/settings.local.json. If it ever held a real credential, rotate or revoke that credential before anything else. Deleting the file does not remove it from history, forks, or clones.

Then stop tracking the file and add it to each repository's own .gitignore. Keep standing permissions narrow, and use a secret manager or runtime variable reference instead of pasting values into commands. An inline assignment such as PASSWORD=value command still places the password in the command text. Review shared agent configuration and transcripts too.

The wider lesson applies to any agent tool, local or cloud: permission memory is data, and it can be as sensitive as the commands it remembers.