Claude Code's 'don't ask again' option is leaking secrets to GitHub
Apiiro found 2,539 credentials across 1,994 public repositories, stored verbatim in settings files after developers approved a command once.
Security researchers at Apiiro published findings on 7 November showing that Claude Code’s “Yes, and don’t ask again” approval option can leak credentials straight into public GitHub repositories. When a developer approves a shell command that way, Claude Code saves the whole command, including any embedded secret, as an allow rule in the project’s .claude/settings.local.json file. If that file gets committed, the secret goes with it.
Apiiro scanned 104,185 public copies of the file across 103,617 repositories and classified 1,122 of them, about 1.1%, as containing secrets, 1,379 distinct values. Widening the search to git history, shared settings and agent transcripts brought the total to 2,539 distinct secrets across 1,994 repositories and 63 organisations, including 379 database passwords, 122 Supabase service-role keys, 43 SSH credentials and 23 AWS keys.
Claude Code does add the settings file to a developer’s global git excludes the first time it writes to it, but that protection lives on the machine, not the project, and does nothing for a file that is already tracked.
Why it matters: if you use Claude Code, check whether .claude/settings.local.json is tracked in any of your repositories, add it to the repo’s own .gitignore rather than relying on global excludes, and rotate anything that’s already been committed.
The caveat: a GitHub issue describing this exact behaviour was filed in August 2025 and auto-closed for inactivity in January 2026. Apiiro’s research suggests the underlying issue was never actually fixed.