# Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets · pwn.watch > When a Claude Code user picks "Yes, and don't ask again" on a shell command, Claude Code can save the exact command, including any password or token typed into it, as an allow rule in .claude/settings.local.json in the project. Claude Code adds that file to the user's global git excludes on one machine, but never to the project's own .gitignore, and does nothing for a file that is already tracked. Apiiro researchers Shmulik Cohen and Matan Giladi published research on Nov 5 2026 that found 104,185 public copies of the file on GitHub, 1,122 of them (about 1.1%) holding at least one secret, 1,379 distinct secrets in total, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys. Counting git history, the shared .claude/settings.json and saved agent chat logs, they counted 2,539 secrets across 1,994 repositories. Apiiro did not test the credentials, but one notified company confirmed its key had been live. Earlier bug reports about the behavior were closed by an automated bot without a reply from Anthropic. Page: https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026 · generated 2026-11-07T15:52:51.004Z ## Status - Severity: high · status: live · patch: unpatched - Product: Anthropic Claude Code (.claude/settings.local.json permission allow rules) - Started: 2026-11-05 - Affected: Claude Code: saving exact approved Bash commands to .claude/settings.local.json is documented default behavior (reproduced by Apiiro with current models) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026.json - This file: https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026/llms.txt ## Updates (newest first) - 2026-11-07: The Hacker News covers the research; the four related Claude Code bug reports the researchers cite have all been closed by a bot with no reply from Anthropic. (https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html) - 2026-11-05: Apiiro publishes the research: 1,122 of 104,185 public .claude/settings.local.json copies hold secrets, 2,539 secrets across 1,994 repositories overall; gitleaks and TruffleHog together missed 215 of the files with secrets. (https://itwire.com/business-it-news/security/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers) - 2026-11-03: Apiiro finishes collecting public GitHub data (Nov 1 to 3) and notifies affected organisations on Nov 2 and 3; one company confirms its exposed key had been live. (https://itwire.com/business-it-news/security/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers) - 2025-08-11: A Claude Code user files a bug report that approved commands with API keys and tokens are stored word for word in settings.local.json; an automated bot later closes it as not planned after 60 days without activity. (https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html) ## Fix brief # Security brief: Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets Source: https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026 · status: live · severity: high · updated Nov 7, 2026, 07:41 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is When a Claude Code user picks "Yes, and don't ask again" on a shell command, Claude Code can save the exact command, including any password or token typed into it, as an allow rule in .claude/settings.local.json in the project. Claude Code adds that file to the user's global git excludes on one machine, but never to the project's own .gitignore, and does nothing for a file that is already tracked. Apiiro researchers Shmulik Cohen and Matan Giladi published research on Nov 5 2026 that found 104,185 public copies of the file on GitHub, 1,122 of them (about 1.1%) holding at least one secret, 1,379 distinct secrets in total, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys. Counting git history, the shared .claude/settings.json and saved agent chat logs, they counted 2,539 secrets across 1,994 repositories. Apiiro did not test the credentials, but one notified company confirmed its key had been live. Earlier bug reports about the behavior were closed by an automated bot without a reply from Anthropic. Severity detail: No CVE or score. Exposure risk rather than a demonstrated breach: Apiiro did not test the secrets, but one company confirmed a live key, and more than a third of the found secrets open a database directly. - Product: Anthropic Claude Code (.claude/settings.local.json permission allow rules) ## Affected versions - Claude Code: saving exact approved Bash commands to .claude/settings.local.json is documented default behavior (reproduced by Apiiro with current models) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you use Claude Code: search your repos and their git history for .claude/settings.local.json and .claude/settings.json, rotate every password, token and key they ever held before cleaning up, then run git rm --cached .claude/settings.local.json and add it to the project's own .gitignore. Delete allow rules that contain secrets from the file on your own machine, keep secrets out of commands (use variables like $DB_URL), and approve patterns such as Bash(npm run:*) instead of exact commands. Make sure secret scanning covers agent folders (.claude/, .cursor/ and similar) and passwords inside commands. ## Latest updates - Nov 7, 2026: The Hacker News covers the research; the four related Claude Code bug reports the researchers cite have all been closed by a bot with no reply from Anthropic. - Nov 5, 2026: Apiiro publishes the research: 1,122 of 104,185 public .claude/settings.local.json copies hold secrets, 2,539 secrets across 1,994 repositories overall; gitleaks and TruffleHog together missed 215 of the files with secrets. - Nov 3, 2026: Apiiro finishes collecting public GitHub data (Nov 1 to 3) and notifies affected organisations on Nov 2 and 3; one company confirms its exposed key had been live. - Aug 11, 2025: A Claude Code user files a bug report that approved commands with API keys and tokens are stored word for word in settings.local.json; an automated bot later closes it as not planned after 60 days without activity. ## Advisories - [Claude Code docs: Configure permissions ("Yes, and don't ask again" saves rules to .claude/settings.local.json)](https://code.claude.com/docs/en/permissions) (Anthropic) ## Write-ups & news - [Claude Code's "Don't Ask Again" File Exposes Passwords and Keys in 1,122 Public Copies on GitHub](https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html) - [Claude Code approval files found exposing company secrets on GitHub, says Apiiro researchers](https://itwire.com/business-it-news/security/claude-code-approval-files-found-exposing-company-secrets-on-github-says-apirro-researchers) - [[BUG] Sensitive tokens stored in .claude/settings.local.json and not ignored by git by default](https://github.com/anthropics/claude-code/issues/13106) --- Machine-readable: https://pwn.watch/i/claude-code-settings-local-json-secrets-exposure-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.