Claude Code's 'don't ask again' file is leaking secrets to public GitHub: 1,379 found so far

Security firm Apiiro found 1,379 distinct secrets sitting in 1,122 public copies of Claude Code's local settings file on GitHub, The Hacker News reported on November 7. The file is .claude/settings.local.json: when you approve a command with "Yes, and don't ask again," Claude Code saves the command word for word, including any password or API key you typed into it. The safeguard Anthropic built (adding the file to your global git excludes) protects only one user on one machine, and does nothing for a file that was already committed or cloned. One company Apiiro notified confirmed its key was still live. If you use Claude Code, the action order is: rotate first, then remove, then change how you approve commands. Deleting the file without rotating changes nothing, because old versions stay in git history and forks.

What actually leaks, and why

Anthropic's own settings documentation describes the mechanism. When Claude Code asks permission to run a Bash command and you pick "Yes, and don't ask again," it writes an allow rule to .claude/settings.local.json inside the project. If the approved command contains a literal secret (a password in a connection string, a token in a curl header), the rule stores that secret in plain text.

Claude Code does try to keep the file out of git: the first time it writes the file in a repository, it adds the pattern to your global git excludes file, per the documentation. But that protection lives in one user's git config on one computer. It is never added to the project's own .gitignore, so it does not travel with the repository, and it cannot help a file that was already committed. Apiiro found that in 539 of the 1,105 repositories it traced, a commit listing Claude as co-author changed the file, meaning the agent often commits its own settings file.

What Apiiro found

All numbers are from Apiiro's research as reported by The Hacker News; Apiiro said it did not test whether the secrets work:

• 104,185 public copies of .claude/settings.local.json across 103,617 repositories. Of those, 1,122 copies (about 1.1%) hold at least one secret: 1,379 distinct secrets in total.
• More than a third open a database directly, including 379 database passwords. Also found: 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. AI Chat Daily reports the secrets belong to 63 organizations, mostly software companies, and that the worst cases included a database vendor's own admin-level cloud key and the owner password of a medical-records database.
• The exposure is persistent: every secret-bearing file was still on its repository's default branch at the time of the research, and in half of those repositories it had been there for at least 217 days. Older file versions hold 734 more secrets across 509 repositories, and 211 forks of 74 repositories carry the same secrets.
• The problem is wider than the local file: 298 of 76,011 copies of the shared, deliberately committed .claude/settings.json also hold secrets, mostly inside allow rules. Including old versions and saved agent chat logs, Apiiro's total is 2,539 secrets across 1,994 repositories.
• Common scanners miss much of it: run over the 1,122 files, gitleaks flagged 564 and TruffleHog 643; 215 files were missed by both.
• Apiiro compared 16 coding agents' documentation and says Claude Code is the only one confirmed to save the full approved command to a project file by default. It reproduced the behavior with the latest models, Opus 5.5 and Fable 5.1.
• Users flagged this as far back as 2025 without a fix; AI Chat Daily reports an August 2025 bug report was closed by an automated process after 60 days of inactivity. Per The Code newsletter, Claude Code head Boris Cherny now says the team is looking into fixes.

What I would do

The researcher's recommendations, in the order that matters:

• Rotate first. Change every password, token and key the file has ever held, then clean up. Removal alone does not help because history and forks keep the old copies.
• Search your GitHub organization for .claude/settings.local.json and .claude/settings.json, including the git history of repositories where the files no longer exist.
• Stop tracking the local file: git rm --cached .claude/settings.local.json, and add it to the repository's own .gitignore so the protection travels with the project.
• Open the file on your own machine, even if it was never committed, and delete every rule that contains a secret.
• Keep secrets out of commands entirely. Reference them as variables from a secrets manager, such as $DB_URL, so a saved rule holds the variable name rather than the value.
• Treat agent folders (.claude/, .cursor/, .gemini/, .specstory/) and agent memory files like .env files, and add them to pre-commit and CI secret scanning, including history. Make sure the scanner catches passwords inside commands, not only known key formats.

What I would not conclude

Do not assume your repository is safe because the file is not in it now: check history and forks, since 734 of the secrets Apiiro found lived only in older versions. Do not rely on the global git excludes protection: it is per-user and per-machine, and any teammate, CI job, or fresh clone bypasses it. Do not assume a passing gitleaks or TruffleHog run means you are clean; both tools missed hundreds of these files in Apiiro's test. And do not read "Anthropic is looking into fixes" as a shipped fix: as of writing, the behavior is unchanged and reproduced on the latest models.

Frequently asked questions

What is .claude/settings.local.json?

A project-level Claude Code settings file for personal overrides. When you approve a command with "Yes, and don't ask again," Claude Code saves that approval as an allow rule in this file, with the full command text. Anthropic's documentation says the file is meant to stay out of git via your global git excludes.

How did secrets end up public if Claude Code excludes the file?

The exclusion is written to one user's global git config on one machine. It is never added to the project's .gitignore, so it does not protect the file for teammates, other machines, or a repository where the file was committed before the exclusion existed. In 539 of 1,105 traced repositories, a Claude co-authored commit changed the file.

I found the file in my repository's history. What now?

Rotate every credential the file has ever contained first, because history and forks preserve old copies. Then git rm --cached the file, add it to the repository's .gitignore, and scrub the rules that contain secrets on every machine you use.

How many secrets were exposed?

Apiiro found 1,379 distinct secrets in 1,122 public copies of the local file, and 2,539 secrets across 1,994 repositories when counting the shared settings file, older versions, and saved agent chat logs. It did not test whether they still work; one notified company confirmed its key was live.

Will gitleaks or TruffleHog catch this?

Only partially. Against the 1,122 secret-bearing files, gitleaks flagged 564 and TruffleHog 643, and 215 were missed by both. Apiiro recommends scanning agent folders and history explicitly, including passwords embedded in commands.

Is Anthropic fixing it?

Users reported the behavior as far back as 2025. The Code newsletter reports that Claude Code head Boris Cherny says the team is now looking into fixes. As of writing, the save-the-full-command behavior is still present on the latest models.

Do other coding agents do this?

Apiiro says that of 16 coding agents whose documentation it compared, Claude Code is the only one confirmed to save the full approved command to a project file by default. Its advice still applies broadly: treat all agent config and memory folders as secret-bearing.

Sources

• Claude Code's "Don't Ask Again" File Exposes Passwords and Keys in 1,122 Public Copies on GitHub | The Hacker News - November 7, 2026, read November 9, 2026. Apiiro's findings, the mechanism, the git-excludes limitation, the scanner comparison, and the remediation list.
• Claude Code settings | Anthropic documentation - read November 9, 2026. Confirms the mechanism: "don't ask again" writes allow rules to .claude/settings.local.json, and the protection is a per-user global git exclude.
• Apiiro says Claude Code permission files exposed 1,379 secrets on public GitHub | AI Chat Daily - November 8, 2026, read November 9, 2026. The 63 affected organizations, the admin cloud key and medical-records database cases, and the August 2025 bug report closed by automation.
• The Code newsletter, November 9, 2026 (email) - Boris Cherny's statement that the team is looking into fixes.

Not read: Apiiro's own research write-up (I could not locate a working copy), and Anthropic's permissions documentation beyond the settings page. Apiiro's counts are its own and it did not test whether the secrets work. Boris Cherny's response is secondhand via The Code.