Claude Code's "don't ask again" saved passwords in a project file: 1,122 reached GitHub. Check yours

On 5 November 2026 Apiiro, a company that sells application security tools, published research called "Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub". It was posted to Hacker News on 7 November as "Claude Code's 'Don't Ask Again' exposes passwords in 1,122 public GitHub files", and had 266 points and 172 comments by the morning of 8 November.

The finding is simple. Claude Code asks before it runs a shell command. One of the answers is "Yes, and don't ask again". Pick it, and Claude Code saves a permission rule so it will not ask about that command again. The rule goes into .claude/settings.local.json, a JSON file inside your project folder. When the rule is the full command, it holds whatever was in the command, and a command that talks to a database or a server often has the password in it.

Apiiro counted every public copy of that file on GitHub and checked each for secrets. Among the cases they confirmed: a database vendor's own cloud API key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records app's database. They reported each case to its owner on 2 and 3 November, and one company confirmed its key had been live.

Start with an ordinary request: "check why login fails on staging". Claude reads your config, finds the database connection string, and proposes a command such as psql with the password in it, because the command does not work without it. Claude Code shows you the command and asks. You have approved twenty of these today, so you pick "Yes, and don't ask again".

Claude Code's permission docs say what happens next: the approval is saved "as an allow rule in .claude/settings.local.json" at the root of the git repository. For many commands the dialog offers a prefix rule such as npm test *, which allows any command that starts with those words and holds no secret. But a rule can also be the exact command, and Apiiro reproduced exact-command rules with secrets in current Claude Code releases. On my own Mac, 60 of the 115 saved Bash rules in this project's file are exact commands with no wildcard (some may have been added by hand). None of them holds a secret, because nothing I approved had one in it, but it shows how often the full text is what gets saved.

This is Claude Code's behaviour, not the model's. The model writes the command; the tool decides to store the approval as text in a file. The file only grows, and size matters: Apiiro found that one file in ten larger than 8 KB held a real secret, against fewer than one in 500 under 500 bytes. The longer you have been clicking, the more the file holds.

Read next: Secrets management: why a secret should never be a literal

Apiiro searched public GitHub between 1 and 3 November 2026 and collected all 104,185 copies of .claude/settings.local.json (in 103,617 repos) and 76,011 shared .claude/settings.json files.

They count a value as a real secret when it matches a known provider format, or when it is a password or token with a public host on the same line, after removing placeholders, default passwords, local hosts and keys that are public by design. Every remaining value was reviewed in masked form by an independent LLM reviewer working from a written rubric, and only values both the rules and the review agreed on were counted. Memory files, handoff notes and Copilot settings were classified by the rules alone. No credential was used or tested, so "real" means it looks usable, not that it was proven live.

Deleting the file does not fix it. Earlier versions of the file in git history held 734 real secrets that are in no current copy, in 509 repos, and 211 forks (copies of a repo made under another account) of 74 repos carry the same secrets. The file was usually old: in the median affected repo it was first committed 217 days before 2 November.

The allowlist is the clearest case, but Apiiro found the same habit, a secret typed into a command that an agent then records, in other files people commit: 298 shared .claude/settings.json files, 120 agent chat transcripts in 87 repos, memory files in 9 repos, 33 handoff and deploy notes (a third of them written by the agent itself), and VS Code Copilot auto-approve settings in 9 repos. They also found the file in 126 of 31,053 Hugging Face Spaces (one with secrets in its rules), and 2 of the 69 public GitLab copies they checked held a real secret.

Of 16 coding agents whose documentation they compared, Claude Code is the only one they confirmed writes the full approved command to a project file by default. That is the part Anthropic can change. The rest is on us: any file an agent writes about what it ran can hold what you typed.

And most of these files never reach GitHub at all. They sit in plain JSON on developer laptops, where credential-stealing malware looks. Apiiro points out that the Shai-Hulud npm worm in September 2025 ran TruffleHog over its victims' files, and that tool flags 643 of the 1,122 files.

Read next: AI supply chain security: what you import runs as you

Boris Cherny of the Claude Code team replied on Hacker News within half an hour. He said Claude Code has not done secret scrubbing, that the team is looking into preventing this, that the file is meant to stay local and is ignored automatically when Claude creates it, that auto mode is the safer choice than allow lists, and that everyone should turn on secret scanning in their source host. In a later reply he said the real threat is that people approving many commands get tired and approve one they should not.

The mechanism was not new. Users reported it in GitHub issues from August 2025: #5544 (approved commands with credentials stored in plain text), #11982 (the file no longer added to .gitignore), #13106 (tokens in the file not ignored by git) and #91270 (VS Code approvals written to the shared, committed settings.json instead). When I checked on 8 November all four were closed: three as not planned, one as a duplicate.

Anthropic had announced no fix when this was written. The most useful one would be for Claude Code to refuse to save a rule that contains a literal secret, or to save only a prefix. Until then, the checklist above is on you.

Every AI agent keeps records of its own actions: permission rules, transcripts, memory files, logs, handoff notes. Each record holds whatever went into the action. So a secret you type into an agent's command does not stay in that command. It is copied into every record the agent keeps, and from there into backups, syncs, zips and commits.

The defence is the same one secrets management has always taught, applied to a new writer: give the agent a reference to the secret, never the secret. Then nothing it writes down is worth stealing.

Read next: Agent identity: give an agent a reference, not your secret

The counts and organisation cases are Apiiro's; I read the study in full on 8 November but did not repeat their GitHub-wide search, and I have not looked at any of the files they found. The Claude Code behaviour is from Anthropic's settings and permissions docs and Boris Cherny's replies; the issue states are from GitHub's API.

I did not run Claude Code's permission dialog with a real secret. The gap simulation, the scanner comparison and the check ran on fake data only, with no network calls. The scanner comparison is a small file I built, so treat it as an illustration of the shapes, not a benchmark.