Claude Code's "don't ask again" option is leaking passwords onto GitHub

The scene is familiar to anyone who codes with an AI assistant. A developer asks Claude Code, Anthropic's programming tool, to test a database connection. The agent prepares a command that contains the password and asks permission to run it. Among the choices: "Yes, and don't ask again." One click, and the command is copied as is, password included, into a file in the project.

That file, .claude/settings.local.json, is not supposed to leave the developer's machine. Yet security firm Apiiro found 104,185 public copies of it on GitHub in a collection run from November 1 to 3. In 1,122 of them, there was at least one real secret: a password, key or access token. The study was picked up on November 7 by The Hacker News, GBHackers and Cybersecurity News.

Production databases among the leaks

These 1,122 files contain 1,379 distinct secrets. More than a third give direct access to a database, including 379 passwords. Apiiro also reports 43 SSH credentials for public servers, some with the root password, 42 GitHub, GitLab or npm tokens, 23 AWS keys and, according to GBHackers, 122 Supabase service keys. The 63 organizations identified are mostly software vendors. Among them are a production PostgreSQL database password on Azure and the password of a medical records database. Counting Git history, the shared .claude/settings.json file and the agent's saved conversations, the total rises to 2,539 secrets across 1,994 repositories.

Apiiro did not test these credentials: here, a "real secret" means something that looks like a credible credential, which does not prove it works. One company did, however, confirm that its exposed key was active, according to Cybersecurity News.

Why detection tools miss them

A second unpleasant surprise: the most widely used secret scanners do not catch everything. Of the 1,122 files, gitleaks flagged 564 and TruffleHog 643, and 215 were caught by neither. A password typed after PGPASSWORD= or sshpass -p looks like an ordinary word in a command line. It does not have the recognizable format of an API key.

Anthropic did plan a safeguard: according to its documentation, Claude Code configures Git to ignore this file when it creates it. But according to Apiiro, that exclusion is written into the developer's global Git configuration. So it does not follow the project to another machine, and it protects neither a file already tracked by Git nor a folder later turned into a repository. Apiiro compared the documentation of 16 coding agents: according to the study, Claude Code is the only one confirmed to save the full approved command in a project file by default. An issue opened on GitHub flagged this plaintext storage as early as August 2025. According to a post on the DEV platform, it was automatically closed on January 3, 2026, for lack of activity. Articles about the study report no response from Anthropic.

What to do if your teams use Claude Code

No sophisticated vulnerability is involved here: a convenience reflex was enough. Apiiro's recommended measures fit in a few lines, provided you apply them in the right order:

• first, change the passwords, tokens and keys these files may have contained, before any cleanup. Deleting the file is not enough, since it remains in Git history, forks and archives;
• remove the file from tracking with git rm --cached .claude/settings.local.json, then add that path to the repository's own .gitignore;
• search your repositories' history for this file and also review .claude/settings.json, which is shared by the team: Apiiro found secrets in 298 of the 76,011 public copies;
• use environment variables or a secrets manager rather than writing a password into a command;
• complement automated scanners with a search for patterns such as PGPASSWORD=, sshpass -p or mysql -p.

The risk is not limited to GitHub: on an infected machine, malware can read these files in plaintext. As with the leak of keys saved in OpenCode, the secrets entrusted to AI coding tools are becoming a target in their own right. It remains to be seen whether Anthropic will change how Claude Code stores permissions.