Claude Code’s “Don’t ask again” button left passwords and API keys in 1,122 public GitHub files, researchers say

Clicking “Yes, and don’t ask again” in Claude Code, Anthropic’s AI coding agent, can save a real database password or API key in plain text to a file that then gets pushed to GitHub for anyone to read. Security firm Apiiro said in research published on November 5 that 1,122 of the 104,185 public copies of that file it found on GitHub hold a real secret.

The exposed credentials include a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token and the owner password for a medical-records app’s database. Apiiro says 63 organisations are affected, mostly software companies, and one confirmed to it that its leaked key had been live. Counting old versions of the file, the shared settings file teams commit on purpose and saved agent chat logs, it puts the total at 2,539 secrets in 1,994 repositories.

How one click saves your password

Claude Code asks before it runs a shell command. Ask it to check a staging database or call an API and the command it proposes often carries the password or token from your config. Choosing “don’t ask again” runs the command and, as Claude Code’s permissions documentation confirms, saves it as an “allow” rule in .claude/settings.local.json in the project folder. Apiiro’s point is that the rule is the command string itself, secret included.

The file is meant to stay on your machine. Claude Code’s settings documentation says that the first time it writes the file in a git repository, it adds it to the developer’s global git excludes, so it stays out of commits. Apiiro says that covers the common case but not a folder that becomes a repository later, a clone on another computer or a file that was already committed, and that the rule never goes into the project’s own .gitignore. In 539 of the 1,105 leaking repositories it traced, a commit co-authored by Claude had changed the file.

Apiiro says this is “Claude Code’s own behavior, not the model’s”: it reproduced it with Opus 5.5 and Fable 5.1, and of 16 coding agents whose documentation it compared, Claude Code was the only one confirmed to write the full approved command to a project file by default. A separate open bug report on Claude Code’s GitHub tracker says approvals are sometimes written to the shared .claude/settings.json instead, a file teams commit deliberately. Apiiro found secrets in 298 of 76,011 public copies of that file.

Deleting the file doesn’t fix it

In the median leaking repository the file was first committed 217 days before Apiiro’s November 2 snapshot. Older versions in git history hold another 734 secrets in 509 repositories, usually where someone deleted the file but not its history, and 211 forks carry the same secrets.

Standard scanners miss many of them. Of the 1,122 files, gitleaks flagged 564 and TruffleHog 643; 215 were caught by neither, usually because the secret is a password typed into a command after PGPASSWORD=, sshpass -p or mysql -p rather than a key in a recognisable format. The file also sits in plain text on every laptop where someone clicked the button, and malware already sweeps developer machines for credentials, as the hijacked LiteLLM package and the hacked Claude Code extension in Cursor showed last month.

Users have reported the behaviour on Claude Code’s GitHub since August 2025. Apiiro cites four such reports and says none got a reply from Anthropic, and three were closed automatically as inactive or duplicates. Anthropic hasn’t commented on the research.

What to check and rotate

• Search: look in your GitHub organisation for .claude/settings.local.json and .claude/settings.json, and check each repository’s git history even if the file has gone.
• Rotate first: change every password, token and key the file has ever held. Removing it doesn’t clean history, forks or other people’s clones.
• Untrack it: run git rm --cached .claude/settings.local.json and add the file to the project’s own .gitignore.
• Clean the local copy: open the file on your own machine and delete any allow rule with a secret in it, even if it was never committed.
• Stop typing secrets into commands: reference them as variables such as $DB_URL and approve patterns like Bash(npm run:*) rather than literal commands.

Apiiro, which sells security products, didn’t test any of the credentials, so “real secret” means one that matches a key format or points at a public host, not one known to work.

Why it matters

This is Claude Code’s second privacy slip to come to light this week, after it was found handing users’ email addresses to websites. A button built to save developers a few clicks has been quietly writing their production passwords into files that are easy to publish, and the fix for anyone affected is rotation, not deletion.

Sources: Apiiro; Claude Code permissions documentation; Claude Code settings documentation; GitHub issue #77530.