Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets

When a Claude Code user picks "Yes, and don't ask again" on a shell command, Claude Code can save the exact command, including any password or token typed into it, as an allow rule in .claude/settings.local.json in the project. Claude Code adds that file to the user's global git excludes on one machine, but never to the project's own .gitignore, and does nothing for a file that is already tracked. Apiiro researchers Shmulik Cohen and Matan Giladi published research on Nov 5 2026 that found 104,185 public copies of the file on GitHub, 1,122 of them (about 1.1%) holding at least one secret, 1,379 distinct secrets in total, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys. Counting git history, the shared .claude/settings.json and saved agent chat logs, they counted 2,539 secrets across 1,994 repositories. Apiiro did not test the credentials, but one notified company confirmed its key had been live. Earlier bug reports about the behavior were closed by an automated bot without a reply from Anthropic.

Why this severity: No CVE or score. Exposure risk rather than a demonstrated breach: Apiiro did not test the secrets, but one company confirmed a live key, and more than a third of the found secrets open a database directly.

Started

Nov 5, 2026

• Anthropic
• #Claude
• #Claude Code
• GitHub
• #Secrets Exposure
• #AI agents
• #Unpatched