Claude Code's 'Don't Ask Again' Leaked 2,539 Secrets Onto GitHub

Security researchers have found 2,539 distinct secrets — passwords, API tokens and private keys — sitting in 1,994 public GitHub repositories, all traceable to a single convenience feature in Anthropic's Claude Code. The firm that found them, Apiiro, links every one to permission rules the coding agent writes when a developer clicks "Yes, and don't ask again."

The mechanics are simple, and that's the problem. When a user approves a shell command with that option, Claude Code writes a permission rule into the project's .claude/settings.local.json file. The rule often contains the full command as typed — credentials included.

How big is the leak?

Apiiro researchers Shmulik Cohen and Matan Giladi examined 104,185 public copies of the file, according to reporting by Ars Technica. They classified 1,122 of them — about 1.1% — as containing secrets, holding 1,379 distinct values. Widening the search to include Git history, the shared settings.json file and agent transcripts pushed the total to 2,539 distinct secrets across 1,994 repositories. Ars reported the secrets traced to 63 organizations.

Apiiro did not test whether the credentials actually worked. But one company the firm notified confirmed its exposed key had been live. And of the roughly 1,100 secrets found in local settings files, 215 slipped past two of the most widely used scanners, gitleaks and TruffleHog.

How does the file reach GitHub?

The file is supposed to stay local. Claude Code adds it to the developer's global Git ignore list when it creates the file. That exclusion, however, doesn't travel with the repository — clone the project to another machine, or turn a folder into a repository later, and the file can be committed.

The agent itself appears involved in some cases. Apiiro found Claude-coauthored commits that changed the settings file in 539 of 1,105 repositories it traced. That doesn't prove Claude pushed every exposed credential.

Nor is this a fresh discovery. A GitHub issue reported the behavior in August 2025; it and related reports were closed automatically after inactivity rather than fixed.

What does Anthropic say?

Boris Cherny of the Claude Code team addressed the findings on Hacker News. "Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this," he wrote. He added that .claude/settings.local.json "is not a file you should check into source control" and claimed the exposed files had been "manually created and checked in."

Cherny urged users to switch to auto mode, which relies on a classifier instead of allow lists, and to enable secret scanning at their Git host. The team will prototype options including making auto mode catch the problem and building in basic secret scanning. When another commenter pointed out that auto mode can still save sensitive commands to settings files, Cherny conceded it was a "good catch."

What should developers do now?

Anyone who used the option should check their repositories immediately. The cleanup order matters:

• Rotate or revoke any exposed credential first — deleting the file doesn't remove it from older commits, forks or other people's clones.
• Untrack the file and add .claude/settings.local.json to the repository's own .gitignore.
• Store passwords in a secret manager or environment variable reference rather than typing them into approved commands, which keeps them out of permission rules entirely.

The findings land days after Anthropic told enterprise customers that an outside security firm may have viewed their account data — a separate incident. With secret scanning still at the prototyping stage and scanner coverage demonstrably incomplete, exposed credentials from the existing 1,994 repositories will remain exploitable until their owners rotate them, one by one.