Claude Code's "don't ask again" approvals left developers' passwords and keys in public GitHub repositories, Apiiro finds
Approved commands can be saved word for word, secrets included, to a project settings file. Apiiro found 1,122 public copies of that file holding at least one secret, and 2,539 secrets in all once older versions, a shared settings file and saved chat logs are counted.
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, according to research by the software security company Apiiro, reported by The Hacker News on November 7. When a user picks "Yes, and don't ask again," Claude Code saves an allow rule in the project file .claude/settings.local.json, and when that rule is the exact command, any password or token typed into it is saved too, in plain text. Apiiro's search of public GitHub found 104,185 copies of the file in 103,617 repositories; 1,122 of them hold at least one secret, 1,379 different secrets in all. Apiiro did not test whether any still work, but one company the researchers notified confirmed its key had been live.
What leaked, and why deleting the file is not enough
More than a third of the secrets open a database directly, including 379 database passwords. Others include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Including older versions of the file, the shared .claude/settings.json file that teams commit on purpose, and saved agent chat logs, the total is 2,539 secrets across 1,994 repositories. Claude Code adds the file to the user's global git excludes on one computer, but never to the project's own .gitignore, and in 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file. Removing it does not undo the leak, because older versions stay in git history and in forks. Common scanners missed many of the cases: of the 1,122 files with a secret, gitleaks flagged 564 and TruffleHog 643, and neither flagged 215, mostly passwords typed inside commands.
Of 16 coding agents whose documentation the researchers compared, Claude Code is the only one confirmed to save the full approved command in a project file by default. An earlier bug report, filed on August 11, 2025, described the same behavior and was closed by an automated bot as "not planned"; the four related reports the researchers cite were all closed by the same bot, and none got a reply from Anthropic, they say.
Why it matters
The researchers' advice is to rotate first: change every password, token and key the files have ever held, then stop tracking the local file with git rm --cached, add it to the repository's own .gitignore, refer to secrets as variables from a secrets manager, and approve patterns such as Bash(npm run:*) instead of single commands. They also recommend treating agent folders such as .claude/, .cursor/ and .gemini/ like .env files in pre-commit and CI secret scanning. A coding agent that writes live credentials into committed files creates a cost that never shows up on the AI bill, so judging what those agents produce has to include what they leave in the repository alongside the code.