Threat watch / Vulnerability
Claude Code: "don't ask again" saved typed secrets in a settings file found in public GitHub repos
Researchers at Apiiro found 1,122 public copies of Claude Code's .claude/settings.local.json file holding at least one real-looking secret, 1,379 distinct secrets in all. When a user approves an exact command with "Yes, and don't ask again", the command is saved as an allow rule, with any password or token typed into it. Apiiro did not test whether the secrets work; one notified company confirmed its key had been live.
- Sector
- Many sectors
- Way in
- Exposed or misconfigured
- Product or vendor
- Claude Code
- How it happened
- When a user picks "Yes, and don't ask again", Claude Code saves an allow rule in .claude/settings.local.json in the project folder. If the rule is an exact command rather than a pattern, any password or token typed into the command is stored in plain text. Claude Code adds the file to the user's global git excludes, not to the project's own .gitignore, and that does nothing for a file already committed. In 539 of the 1,105 repositories Apiiro traced, a commit co-authored by Claude changed the file. Anthropic's Boris Cherny argued that the exposed copies were created manually and checked in.[1][3] Checked 9 Nov 2026
- What was stolen
- No theft is reported. The 1,122 files expose 1,379 distinct secrets: 636 provider-format keys and 743 passwords or tokens tied to public hosts, including 379 database passwords, 122 Supabase service-role keys, 43 SSH logins, 42 GitHub, GitLab and npm tokens and 23 AWS keys. Counting older versions of the file, the shared .claude/settings.json and saved agent transcripts, Apiiro reaches 2,539 secrets across 1,994 repositories. Gitleaks and TruffleHog both missed 215 of the 1,122 files.[1][2] Checked 9 Nov 2026
- Who was impacted
- The owners of the public repositories holding these files, mostly individuals; Apiiro counted 63 organizations among them. Every file with a secret was still on its repository's default branch when Apiiro checked.[1] Checked 9 Nov 2026
- Threat actor
- Not attributed
Timeline
- A GitHub issue on the Claude Code repository reports the problem. According to The Hacker News, an automated bot later closed it as "not planned", with no reply from Anthropic. [1]
- The Hacker News and GBHackers report Apiiro's research: 104,185 public copies of the file in 103,617 repositories, of which 1,122 hold at least one secret. Apiiro says it shared the research with Anthropic before publishing. [1][2][3]
- iTnews reports that Boris Cherny, head of Claude Code, replied on Hacker News: "Historically Claude Code has not done secret scrubbing", adding that the team is looking into what it can do to prevent this. He recommended auto mode over permission rules, plus secret scanning. No shipped fix is reported. [3]