Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets ยท updates https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026 When a Claude Code user picks "Yes, and don't ask again" on a shell command, Claude Code can save the exact command, including any password or token typed into it, as an allow rule in .claude/settings.local.json in the project. Claude Code adds that file to the user's global git excludes on one machine, but never to the project's own .gitignore, and does nothing for a file that is already tracked. Apiiro researchers Shmulik Cohen and Matan Giladi published research on Nov 5 2026 that found 104,185 public copies of the file on GitHub, 1,122 of them (about 1.1%) holding at least one secret, 1,379 distinct secrets in total, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys. Counting git history, the shared .claude/settings.json and saved agent chat logs, they counted 2,539 secrets across 1,994 repositories. Apiiro did not test the credentials, but one notified company confirmed its key had been live. Earlier bug reports about the behavior were closed by an automated bot without a reply from Anthropic. en Sat, 07 Nov 2026 00:00:00 GMT Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets: The Hacker News covers the research; the four related Claude Code bug reports the researchers cite have all been closed by a bot with no reply from Anthropic. https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026 https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026#2026-11-07-991387c7 Sat, 07 Nov 2026 00:00:00 GMT high <p><a href="https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html">Source</a></p> Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets: Apiiro publishes the research: 1,122 of 104,185 public .claude/settings.local.json copies hold secrets, 2,539 secrets across 1,994 repositories overall; gitleaks and TruffleHog together missed 215 of the files with secrets. https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026 https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026#2026-11-05-5e44991a Thu, 05 Nov 2026 00:00:00 GMT high <p><a href="https://itwire.com/business-it-news/security/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers">Source</a></p> Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets: Apiiro finishes collecting public GitHub data (Nov 1 to 3) and notifies affected organisations on Nov 2 and 3; one company confirms its exposed key had been live. https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026 https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026#2026-11-03-1899d0be Tue, 03 Nov 2026 00:00:00 GMT high <p><a href="https://itwire.com/business-it-news/security/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers">Source</a></p> Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets: A Claude Code user files a bug report that approved commands with API keys and tokens are stored word for word in settings.local.json; an automated bot later closes it as not planned after 60 days without activity. https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026 https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026#2025-08-11-fd2adeaf Mon, 11 Aug 2025 00:00:00 GMT high <p><a href="https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html">Source</a></p>