Security

Claude Code’s “don’t ask again” leaked 2,539 secrets to GitHub: how to check and fix

Apiiro found that Claude Code's "Yes, and don't ask again" option saved passwords and API keys into a settings file that ended up in nearly 2,000 public GitHub repos. Here's how to check and fix yours.

Chamith Shirantha

1 hour ago 5 min read

If you use Claude Code, Anthropic’s AI coding assistant, a common time-saving click may have put your passwords on the internet. Security firm Apiiro found that the “Yes, and don’t ask again” option can save full commands, including passwords and API keys, into a settings file that some developers then push to public GitHub repositories. Apiiro counted 2,539 secrets across 1,994 public repositories. Here’s what happened, how to check your projects, and how to fix it.

What did researchers find?

Apiiro researchers Shmulik Cohen and Matan Giladi scanned public GitHub from November 1 to 3, 2026 and published their findings on November 5. According to iTWire and DEV Community:

They found 104,185 public copies of the file .claude/settings.local.json.
1,122 of those files (about 1.1%) contained a real secret, with 1,379 distinct secrets.
Including Git history, shared settings files and saved agent transcripts, the total rose to 2,539 secrets across 1,994 repositories, affecting 63 organizations.

The most common secrets were database passwords and Supabase service-role keys, followed by SSH credentials and tokens for GitHub, GitLab, npm and AWS.

How did the secrets get there?

When Claude Code wants to run a command, it asks for permission. If you click “Yes, and don’t ask again,” it saves that command as an “allow rule” so it won’t ask next time. The problem: it saves the whole command in plain text.

So if you approved something like:

psql postgres://admin:[email protected]/app

then the password is now stored in .claude/settings.local.json. If that file gets committed and pushed to a public repo, anyone can read it.

Remembered commands are carrying credentials into public repositories, exposing a gap between approving an agent’s work and controlling what it leaves behind. Apiiro research, as summarized by iTWire

Isn’t that file ignored by Git?

Partly. According to Anthropic’s documentation, the first time Claude Code writes this file in a Git repository, it adds **/.claude/settings.local.json to your global Git excludes file. But that protection lives only on your machine, not in the project. It can fail when:

The project has its own ignore setup
The file was committed before the protection kicked in
Someone force-added it with git add -f
A teammate clones the repo on a machine without the exclude rule

Apiiro found that in 539 of 1,105 affected repositories it traced, commits co-authored by Claude had changed the settings file. iTWire notes this doesn’t prove Claude added every exposed secret.

How serious is it?

Apiiro did not test whether the credentials still work. iTWire describes it as “an exposure risk, rather than an actual demonstrated breach.”
However, one affected company confirmed its exposed key was still live.
215 affected files were missed by both popular secret scanners, gitleaks and TruffleHog, because passwords typed into commands often don’t look like standard API keys.
Affected organizations were notified on November 2 and 3.

This isn’t brand new: a GitHub issue describing the same behavior was opened in August 2025 and auto-closed in January 2026. As of November 8, there had been no public response from Anthropic, according to DEV Community.

How to check your projects

Search your repos for .claude/settings.local.json and .claude/settings.json. Open them and read them yourself; don’t rely only on scanners.
Check your Git history. Deleting the file doesn’t remove old copies. Run:
```
git log --all -p -- .claude/settings.local.json
```
Look at saved Claude Code transcripts in your repo, if any, for pasted secrets.

How to fix it

Rotate anything exposed. If a password or key ever appeared in a public file, treat it as compromised. Revoke it and create a new one.
Make the file uncommittable. Add this line to your project’s .gitignore:
```
.claude/settings.local.json
```
Then confirm it works with git check-ignore -v .claude/settings.local.json.
Clean your history with a tool like git filter-repo if secrets were committed, but rotate first, since copies may already exist.
Keep secrets out of commands. Use environment variables or a secrets manager, so approved commands look like psql "$DATABASE_URL" instead of containing the password.
Use “don’t ask again” carefully. Save it for harmless, repeatable commands like running tests, not commands with credentials.

Why it matters

AI coding agents are powerful, but they also leave things behind: settings, logs and transcripts. Developers need to treat those files like code and review them before committing. This is the second Claude Code security issue this month, after the fake Claude Code extension on Cursor. Leaked API keys are valuable to criminals, as we explained in our article on LLMjacking and stolen AI keys.

Frequently asked questions

What is .claude/settings.local.json?

It’s a local settings file Claude Code uses to remember permission rules, including commands you approved with “Yes, and don’t ask again.” It’s meant to stay on your computer, not in a shared repository.

How many secrets were leaked by Claude Code settings files?

Apiiro found 1,379 distinct secrets in 1,122 current public settings files, and 2,539 secrets across 1,994 repositories when including Git history and related files.

Is this a bug in Claude?

Not in the AI model. It comes from how the tool saves approved commands in plain text. No attacker is needed; the leak happens when the file is committed to a public repo.

What should I do if my secrets were exposed?

Revoke and rotate the exposed credentials right away, add the settings file to your .gitignore, and check your Git history for older copies.

Disclosure: AI tools, including Claude, helped write this article.

Sources

#API keys #Claude Code #Developers #GitHub #Secrets management

Written by