Claude Code's "Don't Ask Again" file left passwords in 1,122 public GitHub copies

A setting meant to save you from approving the same shell command twice has left real passwords and API keys in public GitHub repositories. Software security company Apiiro searched for copies of Claude Code’s local settings file and found 1,122 public copies that each held at least one secret.

What the researchers found

The Hacker News reported on November 7 on Apiiro’s write-up. According to that account:

• Claude Code asks before it runs most shell commands. If the user chooses “Yes, and don’t ask again,” the tool can save an allow rule in .claude/settings.local.json inside the project. Anthropic’s settings documentation describes that file as project-specific local configuration.
• The saved rule sometimes matches a pattern, such as a test command, and sometimes stores one exact command. When the command itself included a password or a token, that secret was saved in plain text.
• Apiiro found 104,185 public copies of the file across 103,617 repositories. About 1.1 percent of them, or 1,122 copies, held at least one secret, 1,379 distinct secrets in all.
• A value counted as a secret when it matched a known key format, or when a password or token sat next to the address of a public server, and an automated reviewer also agreed. The researchers did not say whether anyone has used these secrets. They did not test whether the secrets still work, except that one company they notified confirmed its key had been live.
• More than a third of the secrets opened a database directly, including 379 database passwords. Others included 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Among the owners were 63 organisations. The strongest cases the researchers described included a database vendor’s admin-level cloud key and the owner password of a medical-records database.
• As of the Monday before the report, every file with a secret was still on its repository’s default branch, and in half of those repositories it had been there for at least 217 days.
• Deleting the file from the project does not finish the job. Older versions in git history held 734 more secrets across 509 repositories. Forks spread the files further: 211 forks of 74 repositories carried the same secrets as the originals.
• Secrets also sat in 298 of 76,011 public copies of the shared .claude/settings.json file, which teams commit on purpose. Counting those, the older versions and saved agent chat logs, Apiiro’s total was 2,539 secrets across 1,994 repositories.

Claude Code does try to keep the local file out of git, the researchers said: the first time it writes the file in a repository, it adds the file to that user’s global git excludes. That protection stays on one computer. It does not add the file to the project’s own .gitignore, so it does not travel with the project, and it does nothing for a file that was already committed. In 539 of the 1,105 repositories Apiiro traced, a commit listing Claude as a co-author changed the file.

Of 16 coding agents whose documentation the researchers compared, Claude Code was the only one they confirmed saves the full approved command in a project file by default. Users had reported the behaviour before. An earlier report filed on August 11, 2025, said approved commands with API keys were being stored word for word. The Hacker News said that report, and later related ones, were closed by an automated bot without a reply from Anthropic.

What this means for you

This is not a break-in at Anthropic, and it is not a list of every Claude Code user. It is a finding about a file that can quietly collect secrets you typed into commands, then follow the project into GitHub if anyone commits it. Copies that never reach GitHub still matter: the file is ordinary text in the project folder, and it can travel inside a package, a container image, a zip file or a synced folder.

Common secret scanners missed many of these files, Apiiro said, because a password sitting inside an ordinary command does not always look like a cloud key.

What you can do

1. Search your GitHub organisation and each repository’s history for .claude/settings.local.json and .claude/settings.json, including places where the files have since been deleted.
2. Rotate every password, token and key those files have ever held, before you clean up. Removing the file does not revoke a key that was already copied.
3. Stop tracking the local file (git rm --cached .claude/settings.local.json) and add it to the repository’s own .gitignore. Open the copy on your computer and delete any rule that contains a secret.
4. Keep secrets out of the commands you approve. Refer to them as variables from a secrets manager, so a saved rule holds the variable name. Prefer approving a pattern rather than one exact command.
5. If you run security for a team, treat agent folders such as .claude/ the way you already treat .env files, including in pre-commit checks and in git history.

How Frame helps

This is a finding about secrets checked into git, not a published customer breach list. The steps above are the useful part. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• A new infostealer goes after AI tool logins as well as passwords: malware already looks through local AI-tool folders for credentials, which is one reason these files matter even when they never reach GitHub.
• WorkOS says an AI-assisted attack reached its sales tool, with customer contacts and Slack excerpts: a separate incident, also involving an AI coding agent, that shows how quickly an automated tool can collect what it is allowed to reach.

Sources

• The Hacker News, Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub, November 7, 2026
• Anthropic, Settings files and precedence, Claude Code documentation