Title: “Yes, and Don’t Ask Again”: Claude Code Seals Secrets into Project Files That End Up on GitHub
Summary:
Apiiro’s research — its release dated November 6 per The Hacker News — describes a slow-motion secrets leak in Anthropic’s Claude Code: when a user approves a proposed shell command containing a credential and picks “Yes, and don’t ask again,” the assistant stores that exact command — secret included — in plain text in .claude/settings.local.json inside the project, a file the repository doesn’t treat as private. Searching public GitHub, the scan found 104,185 copies across 103,617 repositories, of which 1,122 (about 1.1%) hold a real secret: 1,379 distinct values in committed files — 379 database passwords, 43 SSH logins for public servers, 42 GitHub/GitLab/npm tokens, 23 AWS keys — rising to 2,539 secrets across 1,994 repositories once git history, the shared .claude/settings.json teams commit on purpose, and agent chat transcripts are counted; 63 organizations are affected, and one confirmed company key was live. The flaw is in Claude Code’s own approval behavior, not the model: the researchers reproduced it with Opus 5.5 and Fable 5.1. Claude Code’s global git-excludes stanza for the file never reaches the project’s .gitignore, does nothing for copies already committed, and leaves forks alone — forks of 74 repositories carry the same secrets, earlier versions of the file hold 734 more secrets across 509 repos, and every exposed file still sat on its repository’s default branch, and in half of those repositories it had been there for at least 217 days. Generic scanners miss a chunk of this: gitleaks flagged 564 of the 1,122 files, TruffleHog 643, and 215 were caught by neither, mostly passwords inside command text. Users had flagged the mechanism on GitHub (issue #5544) in August 2025. Treatment is rotation-first: rotate every credential the file ever held, then clean the trackable copies (git rm --cached, history purge where warranted), because the file only avoids commits through Claude Code’s own global excludes.
References:
- The Hacker News: Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
- anthropics/claude-code issue #5544: approved bash commands with credentials stored in plaintext in settings.local.json
- Claude Code docs: settings — settings.local.json stays out of commits via global git excludes