# Claude Code 'Don't Ask Again' — passwords leak in 1,122 public GitHub files

> Approved shell commands, saved word for word, put real passwords into public GitHub repos.

- Org: Apiiro
- Date: 2026-11-07
- Category: security
- Source: https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
- Canonical page: https://ai-tldr.dev/releases/apiiro-claude-code-dont-ask-again-secrets/

## In short

Apiiro found passwords in 1,122 public GitHub files saved by Claude Code's 'Don't Ask Again' option. Approved commands land in .claude/settings.local.json with any secret typed inline, and some repos committed that file.

## What it is

Apiiro, a security firm, reports 1,122 public GitHub files where Claude Code's saved permission rules expose passwords. The file is .claude/settings.local.json, which is meant to stay on the developer's machine. Apiiro traced 1,105 repos with a real secret, and in 539 of them a commit co-authored by Claude changed the file.

## How it works

When a user picks 'Yes, and don't ask again' for a Bash command, Claude Code saves that approval as an allow rule in .claude/settings.local.json. The rule stores the command text, so a password or API key typed into the command is written to disk too. Claude Code adds the file to git's ignore list when it creates it, but files that were created by hand or force-added still get committed and pushed.

## Why it matters

Any team using coding agents can now have live credentials sitting in a config file nobody reviews. Apiiro also reports that 5% of the settings it studied allow any shell command and another 43% allow interpreters like Bash(python:*), which in practice is almost the same. Boris Cherny from the Claude Code team said the tool has not scrubbed secrets so far and that the team is looking into it.

## Who it's for

developers and security teams using Claude Code or other coding agents

## Try it

git ls-files | grep settings.local.json

## Quick facts

- Researcher: Apiiro
- Public files with secrets: 1,122
- Repos with a real secret: 1,105 (539 with a Claude co-authored commit)
- File: .claude/settings.local.json
- Trigger: 'Yes, and don't ask again' on a Bash command
- Anthropic response: Looking into secret scrubbing; recommends auto mode

## FAQ

### How do I check if my repo leaked secrets from Claude Code?

Developers can check whether .claude/settings.local.json is tracked in git, for example with git ls-files, and read the allow rules inside it. Any password or API key that appears in a saved Bash command should be rotated. Boris Cherny from the Claude Code team also told everyone to turn on secret scanning on their source host, whatever coding agent they use.

### Isn't settings.local.json supposed to be gitignored?

Claude Code's settings docs say that when it first writes .claude/settings.local.json in a repo that does not already ignore it, Claude Code adds the file to the global git excludes list. Boris Cherny said this means the leaked files were likely created by hand and then committed. Apiiro still found 539 repos where a Claude co-authored commit changed the file.

### What did Anthropic say about the Apiiro report?

Boris Cherny of the Claude Code team replied on Hacker News that Claude Code has not done secret scrubbing so far and the team is looking into preventing this. He said permission rules are 'old hat', that everyone should use auto mode instead, and that the team will look into exposing more data to hooks so users can block secrets.

### Are broad permission rules part of the problem?

Apiiro's data says yes. In the Claude Code settings files Apiiro studied, 5% allow any shell command outright, and another 43% have interpreter rules such as Bash(python:*) that Apiiro calls essentially equivalent in practice. In the Hacker News thread, many commenters argued that running agents in a container or VM is safer than relying on allow rules.

## Links

- [Apiiro Report](https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again)
- [HN Discussion](https://news.ycombinator.com/item?id=50407882)
- [Claude Code Settings](https://code.claude.com/docs/en/settings)