Claude Code’s “don’t ask again” option has put more than 2,500 secrets into public GitHub repositories

Researchers at the security firm Apiiro report finding 2,539 distinct secrets, including database passwords, cloud keys and SSH logins, in 1,994 public GitHub repositories. Most of them come from one Claude Code file, .claude/settings.local.json. When a user approves a shell command with “Yes, and don’t ask again”, Claude Code saves that exact command in the file, with any password typed into it.

Why the file ends up on GitHub

The settings file is meant to stay on the developer's machine. When Claude Code creates it inside a git repository, it adds it to the developer's global ignore list, but not to the repository's own .gitignore. That protection does not travel with the project. A folder that becomes a repository later, a clone on another machine and a file that was already committed are all left uncovered.

Apiiro also reports that in 539 of the 1,105 repositories it traced, a commit co-authored by Claude changed the file. Claude Code's commit instructions tell the model not to commit .env or credentials.json, but its own settings file is not on that list.

What the count shows

According to Apiiro, public GitHub held 104,185 copies of the file, and 1,122 of them contained a real secret. The total of 2,539 also covers earlier versions of the file, the shared settings.json that teams commit on purpose, and saved agent transcripts. The firm says 63 organizations are affected, from student groups to software vendors.

Deleting the file is not enough. Earlier versions still hold 734 secrets that appear in no current copy, and forks carry copies of their own. Two common secret scanners, gitleaks and TruffleHog, together missed 215 of the 1,122 files, because a password typed after PGPASSWORD= or sshpass -p looks like an ordinary word in a command line.

Apiiro did not try any of the credentials. In its count, a real secret is one that matches a known key format or sits next to a public host, which is not proof that it still works.

What to do

Apiiro's advice for anyone who uses Claude Code is direct:

• If the file is tracked, remove it with git rm --cached .claude/settings.local.json and add it to the repository's own .gitignore.
• Rotate every credential the file has ever held, since removing it does not clear git history, forks or clones.
• Open the local file even if it was never committed, and delete every rule that contains a secret.
• Reference secrets through environment variables such as $DB_URL, so the saved rule does not contain the value.
• Approve patterns such as Bash(npm run:*) instead of literal commands.

What Anthropic says

Users have reported the same behavior in Claude Code issues since August 2025, and Apiiro says none of those reports received a reply from Anthropic. Apiiro published the research on November 5, 2026. On November 7, 2026, Boris Cherny, who leads Claude Code at Anthropic, wrote on Hacker News that the team is looking into how to prevent it. He named two options: making auto mode catch such commands and adding basic secret scanning.