@readmodelmag
MODEL
Subscribe

AI News

Claude Code's 'don't ask again' button saved passwords into files that ended up on GitHub

SummarySecurity firm Apiiro says 1,122 public copies of Claude Code's .claude/settings.local.json hold at least one secret, because the approval can save the exact command you typed, password and all. Rotate first, then clean up.

· MODEL Editors · 2 min read

Some links may be affiliate links. Disclosure

MODEL three-panel cartoon on a cream background. Headline: Yes, and don't ask again. Subhead: It didn't ask again. It also didn't forget your password. Panel 1, You, at 2 a.m.: a dark permission prompt asking Allow this command? for PGPASSWORD=hunter2 psql -h db.prod..., with buttons Yes, Yes and don't ask again (highlighted blue, mouse pointer on it) and No, captioned sleepy click. Panel 2, The agent, taking notes: a .claude/settings.local.json file with an allow rule containing the same command, the fake password hunter2 circled in red, and a smiling cartoon robot saying Saved it word for word! Panel 3, git push, months later: a public repo file list with .claude/settings.local.json highlighted, and rows of cartoon eyes peering at it, captioned Everyone else: hunter2? thanks! Footer: Apiiro: 1,122 public GitHub copies of that file held secrets (1,379 in all). Fix: rotate keys, gitignore the file per repo, keep secrets in env vars. Watermark MODEL · readmodelmag.com.
hunter2 is a joke placeholder, not a real leaked password. Illustration by MODEL; no real faces or logos. Illustration by MODEL. Original. Image source.

What happened. When Claude Code asks to run a shell command and you pick "Yes, and don't ask again," it saves that approval as an allow rule in .claude/settings.local.json in the project (Claude Code docs (opens in a new tab)). Sometimes the rule is a pattern like npm test *. Sometimes it is the exact command, and then any password or token you typed inline is saved too, in plain text (The Hacker News (opens in a new tab)).

What Apiiro found. Security company Apiiro searched public GitHub and found 104,185 copies of the file in 103,617 repositories. About 1.1%, or 1,122 copies, hold at least one secret, 1,379 distinct secrets in all. More than a third open a database directly, including 379 database passwords; others include 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys. Counting older versions in git history, forks, the shared .claude/settings.json and saved agent chat logs, Apiiro puts the total at 2,539 secrets across 1,994 repositories. In 539 of 1,105 traced repos, a commit listing Claude as co-author changed the file.

Why the safety net missed. Claude Code adds the file to your global git excludes the first time it writes it, so it stays out of commits on that one computer. That does not travel with the project, and it does nothing for a file that was already committed or created by hand. Standard scanners also missed many: gitleaks flagged 564 of the 1,122 files, TruffleHog 643, and neither caught 215, mostly passwords typed inside commands like PGPASSWORD= or mysql -p.

What to do.

  1. Search your org for .claude/settings.local.json and .claude/settings.json, including git history.
  2. Rotate every password, token and key those files ever held, before cleaning up.
  3. git rm --cached .claude/settings.local.json and add it to the repo's own .gitignore.
  4. Keep secrets out of commands; use variables like $DB_URL from a secrets manager.
  5. Approve patterns such as Bash(npm run:*) instead of single commands.

Caveats. These are Apiiro's own findings, and Apiiro sells security products. It did not test whether the secrets still work; one notified company confirmed its key had been live. Exposure is not proof anyone used them. Not tested by MODEL. Related: Your coding agent can read your .env.

Disclosure: Not sponsored. No affiliate links. Not tested by MODEL.

MODEL Editors

Sources

  1. Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

    The Hacker News

  2. Claude Code settings: Settings files and precedence

    Anthropic (Claude Code docs)

Keep reading

FREE · EVERY WEEK

The top AI tools this week, tested.

Every week MODEL's editors pick the AI tools worth your time, try them hands-on, and tell you what's good, what's not, and who it's for. Free, in your inbox.

Free. Unsubscribe anytime. Our picks are editorial and can't be bought.