Passwords and API keys that developers typed into commands approved in Claude Code, Anthropic’s AI coding assistant, are sitting in public GitHub repositories, where anyone can read them, security researchers have found.
The exposure comes from a convenience feature. When Claude Code asks permission to run a shell command, the user can choose “Yes, and don’t ask again”. The tool then saves the approved command word for word — including any password or token typed into it — in a project settings file called .claude/settings.local.json, so matching commands run without asking in later sessions.
Software security company Apiiro scanned public GitHub between 1 and 3 November and found 104,185 copies of that file in 103,617 repositories. About 1.1 per cent of them — 1,122 copies — held at least one real secret, 1,379 distinct credentials in all. More than a third open a database directly, including 379 database passwords, alongside 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 Amazon Web Services keys. The strongest cases included a database vendor’s own admin-level cloud key and the owner password of a medical-records database.
Counting older versions of the file, shared settings files and saved agent chat logs, the total rises to 2,539 secrets across 1,994 repositories, affecting 63 organisations, mostly software companies. In half of the repositories with a secret in the current file, it had been there for at least 217 days, and every file with a secret was still on its repository’s default branch as of Monday. Forks spread the files further: 211 forks of 74 repositories carry the same secrets as the originals.
Deleting the file does not undo the leak, because older versions remain in git history and in forks. The researchers’ advice is to rotate first — change every password, token and key the file has ever held — and only then clean up.
Claude Code does try to keep the file out of version control: the first time it writes the file in a git repository, it adds it to the user’s global git excludes. But that protection lives in one user’s settings on one computer, the researchers say, and it does nothing for a file that was already committed. The tool never adds the file to the project’s own .gitignore, so the protection does not travel with the project. In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file, suggesting the assistant often commits the file itself.
Common secret scanners missed many of the files. The researchers ran gitleaks and TruffleHog over every copy: gitleaks flagged 564 of the 1,122 files and TruffleHog 643, while neither flagged 215. Most of the misses were passwords typed inside commands, which do not look like keys in a recognisable format.
Apiiro did not test whether the exposed credentials still work, and the researchers say they found no confirmed evidence that any had been exploited, although one company they notified confirmed its key had been live. Users had reported the behaviour before: a bug report filed in August 2025 said approved commands with API keys and tokens were being stored word for word. The researchers say all four related reports they cite have been closed by an automated bot, the most recent the day before their findings were published, and none received a reply from Anthropic.
Sources: Apiiro — https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again ; The Hacker News — https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
