Claude Code's “don't ask again” option leaked passwords: 1,122 public files held 2,539 real secrets

Security firm Apiiro reported on November 5 that the “Yes, and don't ask again” approval option in Claude Code, Anthropic's AI coding tool, can leak real passwords and API keys into public GitHub repositories. Scanning between November 1 and 3, the researchers found real secrets in 1,122 of 104,185 public copies of .claude/settings.local.json, holding 1,379 distinct credentials.

A wider search found 2,539 secrets in total

Checking earlier commits, shared settings files and agent conversation records brought the total to 2,539 distinct secrets across 1,994 public repositories, affecting 63 organisations, mostly software companies. The exposed credentials included a database vendor's admin-level cloud key, a production Azure PostgreSQL password, a Square production token and the owner password for a medical-records database; one company confirmed to Apiiro that its exposed key had been live. Database passwords accounted for the largest share, 379 in total, along with 122 Supabase service-role keys and 43 SSH logins, some containing root passwords.

One approval writes the password into a settings file, then it gets pushed online

The leak follows an ordinary development flow: a developer asks Claude Code to check a database, test an API or troubleshoot a failed login, and the tool prepares a shell command containing a credential, then asks for permission before running it. Choosing “Yes, and don't ask again” stores that command, including its secret, in the project's .claude/settings.local.json as an allow rule, so Claude Code can run it again without another prompt; once that file is committed and pushed to GitHub, the password is public. Claude Code tries to prevent this by adding an exclusion to the developer's global Git ignore file when it first writes the file inside a Git repository, but that protection does not travel with the project, cover files already tracked, or reliably protect a folder turned into a repository later.

Standard scanners missed about a fifth of the files

Standard secret scanners did not catch everything either: of the 1,122 affected settings files, Gitleaks flagged 564 and TruffleHog flagged 643, and neither tool flagged 215, because passwords embedded after PGPASSWORD=, sshpass -p or inside request headers often lack the clear formats used to recognise provider-issued keys. Apiiro advises developers to search current files and Git history for .claude/settings.local.json, revoke exposed credentials before removing files or rewriting history, and use secret-manager references rather than literal passwords in commands. As of November 8, Anthropic had not publicly responded. Apiiro stressed that it did not actually try the credentials, and only one company confirmed a key was valid; the incident is a credential exposure, not a confirmed breach.