Claude Code's Don't Ask Again option saved passwords to a file that ended up on public GitHub

Security firm Apiiro found real passwords and keys in 1,122 public Claude Code settings files. They appeared when developers chose "Yes, and don't ask again" for a command containing a secret.

Around 5 November 2026 the security firm Apiiro published an analysis of .claude/settings.local.json files on public GitHub. It reviewed 104,185 public copies of the file and found at least one real secret in 1,122 of them, about 1.1 percent. In total that file alone held 1,379 distinct secrets. The story reached the Hacker News front page with more than 300 points.

The cause is mundane. When Claude Code asks to run a command and the developer picks "Yes, and don't ask again", the approved command is stored as a rule in a local settings file. If the command contained a database URL with a password or a token, that secret is stored too, in plain text. All it takes is one accidental commit to publish it.

Counting git history, the shared settings file and agent transcripts, Apiiro reports 2,539 distinct secrets across 1,994 repositories. Coverage lists 379 database passwords, 42 GitHub, GitLab and npm tokens, 43 SSH logins and 23 AWS keys. Apiiro does not say whether anyone abused them. Reports say Anthropic's documentation has Claude Code add the file to the developer's global git ignore list the first time it writes it, but not to the repository's own .gitignore. We found no official Anthropic statement or fix at the time of writing.

Does this affect you? Yes, if your developers use Claude Code and have public repositories, or repositories that may be made public later. Check whether git tracks the file, remove it with git rm --cached and add it to .gitignore. Deleting the file is not enough because it stays in history. Treat every password or token that was ever in it as compromised and rotate it.