Claude Code’s ‘Don’t Ask Again’ Button Leaked 2,539 Secrets Onto Public GitHub
Key takeaway: Security firm Apiiro found 2,539 passwords, API keys and other secrets sitting in public GitHub repositories after Claude Code saved approved shell commands — secrets included — in a project settings file. Clicking “Yes, and don’t ask again” stored the exact command in .claude/settings.local.json, and in 1,122 cases that file reached public GitHub.
Claude Code is Anthropic’s AI coding assistant, and the leak is not a flaw in its language model. It is a behaviour of the tool itself: when a developer approves a shell command and picks “Yes, and don’t ask again”, Claude Code writes that exact command into a local settings file as a standing allow rule. If the command carried a database password, a cloud key or an SSH login, the secret went into the file in plain text — and from there, into version control.
Apiiro published the research on November 5, 2026. The Hacker News reported the findings on November 7. As of November 8, Anthropic had not published a public response.
What Apiiro found on public GitHub
Apiiro searched public GitHub between November 1 and 3, 2026, for copies of .claude/settings.local.json. It found 104,185 copies across 103,617 repositories. About 1.1% of them — 1,122 files — held at least one real secret, adding up to 1,379 distinct credentials.
| What was exposed | Count |
|---|---|
| Database passwords | 379 |
| Supabase service-role keys | 122 |
| SSH logins for public servers | 43 |
| GitHub, GitLab and npm tokens | 42 |
| AWS keys | 23 |
The strongest cases Apiiro names are a database vendor’s own admin-level cloud key, a production Azure Postgres password, a Square production token and the owner password of a medical-records database. Sixty-three organisations are affected, mostly software companies. One company that Apiiro notified confirmed its exposed key had been live.
Counting older versions in git history, the shared .claude/settings.json file that teams commit on purpose, and saved agent chat transcripts, the total reaches 2,539 secrets across 1,994 repositories. Git history alone added 734 secrets in 509 repositories — files deleted from current code but alive in past commits. As of Apiiro’s November 2 snapshot, every secret-bearing file was still on its repository’s default branch, and in half of those repositories it had been there for at least 217 days.
Why the usual safeguards didn’t stop it
Claude Code does try to keep the file out of git. The first time it writes the file inside a repository, it adds it to the developer’s global git excludes, so Git ignores it on that computer. The protection lives in one user’s git settings on one machine: Claude Code never adds the file to the project’s own .gitignore, so the protection does not travel with the project. Clone the repository elsewhere, commit from a machine without that exclude, or let the agent commit the file itself — in 539 of the 1,105 repositories Apiiro traced, a commit listing Claude as co-author changed the file — and the secret goes along.
Secret scanners did not save the day either. Apiiro ran gitleaks and TruffleHog over all 104,185 files. Gitleaks flagged 564 of the 1,122 secret-bearing files; TruffleHog flagged 643. Neither flagged 215 of them — about one in five. Most misses were passwords typed inside commands, after PGPASSWORD= or sshpass -p: to a scanner looking for known key formats, those look like ordinary words in an ordinary command line. That matters because attackers already hunt developer machines for exactly this kind of file — in September 2025, the Shai-Hulud worm ran TruffleHog over infected computers looking for credentials.
Apiiro also compared the documentation of 16 coding agents. Claude Code was the only one confirmed to save the full approved command in a project file by default. And it reproduced the behaviour with Anthropic’s latest models, Opus 5.5 and Fable 5.1: “This is Claude Code’s own behavior, not the model’s.”
What to check right now
Apiiro’s advice, in order, is to rotate first and clean up second — deleting the file does not undo the leak, because older versions stay in git history and in forks.
- Search your GitHub organisation for
.claude/settings.local.jsonand.claude/settings.json, and check each repository’s git history for them, even where the files are gone. - Rotate every password, token and key the files have ever held — before cleaning anything up.
- Stop tracking the local file with
git rm --cached .claude/settings.local.jsonand add it to the repository’s own.gitignore. - Open the file on your own computer, even if it was never committed, and delete every rule that contains a secret.
- Keep secrets out of commands. Use variables from a secrets manager, such as
$DB_URL, so the saved rule holds the variable name, not the secret — and approve patterns, such asBash(npm run:*), instead of single commands.
Claude Code users reported this behaviour before. A bug report filed on August 11, 2025, said approved commands with API keys were being stored word for word in settings.local.json. An automated bot closed it as “not planned” on January 3, 2026, after 60 days without activity. The four related reports Apiiro cites have all been closed by the same bot, the most recent on November 6. None received a reply from Anthropic.
What is confirmed — and what isn’t
Confirmed: the mechanism is real and reproducible; 1,122 public settings files hold secrets; one notified company confirmed its key was live; the files sat in public repositories for months; and the behaviour was reported to Anthropic more than a year ago.
Not confirmed: Apiiro did not test any credential or contact any host, so its figures show exposure, not breaches — the researchers do not say whether anyone has used these secrets. One caveat also matters: Apiiro sells security products for coding agents, and its totals have not been independently replicated, though security firm ironPeak described the same problem in February 2026.
Our take
Analysis: this is a design flaw, not a one-off slip. The convenience of “don’t ask again” is real, but Claude Code stores the secret as part of the permission, then protects the file with a setting that lives on one machine instead of in the repository. The fix that matters most is the cheapest one: rotate the credentials, then put the file in the project’s .gitignore. And the lesson generalises — as AI coding agents gain the power to run commands and commit code, every file they write should be treated as if it will end up public. This week, for 2,539 secrets, it did.
If USABite’s explainers help you, add us as a preferred source in Google Search so our coverage shows up first.
Frequently asked questions
How did Claude Code leak passwords and API keys to GitHub?
When a developer approved a shell command in Claude Code and picked “Yes, and don’t ask again”, the tool saved the exact command — secrets included — as an allow rule in the project file .claude/settings.local.json. The file is meant to stay on the developer’s machine, but in 1,122 cases it was committed and pushed to public GitHub repositories, where anyone could read it.
How many secrets were exposed in the Claude Code leak?
Apiiro found 1,379 distinct secrets in 1,122 public copies of the settings file, including 379 database passwords, 122 Supabase service-role keys and 43 SSH logins. Counting git history, shared settings files and agent transcripts, the total reaches 2,539 secrets across 1,994 public repositories.
Why didn’t Git or secret scanners catch the leaked file?
Claude Code adds the file to the developer’s global git excludes, which protects it only on that one computer — it never adds the file to the project’s own .gitignore, so the protection does not travel with the repository. Secret scanners also missed about one in five affected files, mostly because the secrets were passwords typed inside commands rather than keys in a recognisable format.
What should I do if I use Claude Code?
Search your GitHub organisation for .claude/settings.local.json and .claude/settings.json, including git history. Rotate every credential those files have ever held before cleaning up, remove the file from tracking with git rm --cached, add it to your project’s .gitignore, and stop putting secrets directly into commands — use environment variables from a secrets manager instead.
Has Anthropic fixed the problem?
As of November 8, 2026, Anthropic had not published a public response, and the researchers reported no product change. A bug report describing the same behaviour was filed in August 2025 and closed automatically in January 2026 as “not planned”. Until Anthropic changes the behaviour, the safeguards are the ones developers apply themselves.
Sources: Apiiro, “Coding Agents Are Leaking Your Secrets to GitHub” (November 5, 2026); The Hacker News, “Claude Code’s ‘Don’t Ask Again’ File Exposes Passwords and Keys in 1,122 Public Copies on GitHub” (November 7, 2026). Related USABite coverage: Apple Quietly Ships an Official Xcode Plugin for Claude Code and A Tampered Claude Code Extension Reached 5,000 Cursor Users.
