Claude Code's “don't ask again” approvals leaked secrets into 1,122 public GitHub files, Apiiro says

Security company Apiiro reported this week that passwords and API keys typed into commands approved in Claude Code, Anthropic’s AI coding agent, are sitting in public GitHub repositories, The Hacker News reported on 7 November 2026.

How it happens

When a user picks “Yes, and don’t ask again,” Claude Code saves an allow rule in the project file .claude/settings.local.json. Sometimes the rule is a pattern (such as npm test *), but sometimes it is the exact command — including any password or token typed into it, in plain text. Claude Code adds the file to the user’s global git excludes on that computer, but not to the project’s own .gitignore, so the protection does not travel with the project or cover files already committed. In 539 of 1,105 traced repositories, a commit listing Claude as co-author changed the file.

What Apiiro found

• 104,185 copies of the file in public GitHub repos; about 1.1% (1,122) contain at least one secret, 1,379 distinct secrets in total.
• Among them: 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys; 63 organizations among the owners.
• Older git history held 734 more secrets; including shared settings files and agent logs, the total was 2,539 secrets across 1,994 repositories.
• Common scanners missed many: gitleaks flagged 564 and TruffleHog 643 of the 1,122 files; neither flagged 215.

Apiiro did not test whether the secrets still work, though one notified company confirmed its key had been live. Of 16 coding agents compared, Claude Code was the only one confirmed to save the full approved command in a project file by default. Earlier user bug reports about the behavior were closed by an automated bot without a reply from Anthropic, according to the researchers.

What developers should do

Rotate every credential the file ever held before cleaning up; then run git rm --cached .claude/settings.local.json, add it to the repo’s .gitignore, check git history and forks, keep secrets in environment variables, and approve patterns rather than single commands.

Limits

These are a vendor’s research findings as reported by The Hacker News; Anthropic’s response was not reported. Whether any secrets were abused is unknown.