Apiiro: Claude Code's "Don't Ask Again" Option Saved Passwords in 1,122 Public GitHub Files

Passwords and API keys are sitting in public GitHub repositories because developers clicked "Yes, and don't ask again" in Anthropic's Claude Code, according to research published November 5 by the security company Apiiro.

The researchers, Shmulik Cohen and Matan Giladi, say the option can save the approved shell command word for word in `.claude/settings.local.json`. If the command carried a password, the password is saved too.

How a password lands in the file

The sequence is ordinary. A developer asks Claude Code to check a database, test an API or troubleshoot a failed login. Claude proposes a shell command that includes a credential pulled from a config file, then asks permission to run it.

Choosing "Yes, and don't ask again" writes an allow rule into the project's local settings file. Anthropic's permissions documentation says matching commands then run without a prompt in later sessions. Sometimes the rule is a pattern such as `npm test *`. Sometimes it is the exact command, secret included.

Apiiro says no malicious prompt or stolen account is needed. The exposure follows a normal approval flow.

The numbers

Apiiro searched public GitHub between November 1 and 3 and found 104,185 copies of the file across 103,617 repositories. Of those, 1,122 copies, about 1.1%, held at least one real secret. Together they held 1,379 distinct secrets.

Widen the search to git history, shared settings files and agent transcripts, and Apiiro's count rises to 2,539 secrets across 1,994 repositories.

More than a third of the secrets open a database directly. Apiiro counted 379 database passwords, 122 Supabase service-role keys and 103 Supabase account tokens. It also found 43 SSH logins, some with root passwords, plus 42 GitHub, GitLab and npm tokens, 23 AWS keys and six private keys.

Sixty-three organizations are affected, mostly software companies. Apiiro cited a database vendor's admin-level cloud key, a production Azure PostgreSQL password, a Square production token and the owner password for a medical-records database.

What Apiiro did and did not verify

Apiiro notified owners on November 2 and 3. One company confirmed its exposed key had been live.

The firm says it did not test any credential or contact any host: "No credential was used or tested, and no host was contacted." It has not said whether anyone else has used the exposed secrets.

The files are not new. Apiiro says every one sat on its repository's default branch on November 2, and in the median repository the file had been there 217 days. Larger files leak more. One in ten files over 8 KB held a real secret, against fewer than one in 500 under 500 bytes, because each approval adds another saved command.

The git safeguard and where it stops

Anthropic's settings documentation says Claude Code tries to keep the file out of version control. The first time it writes the file inside a git repository, it adds `/.claude/settings.local.json` to the user's global git excludes, so the file stays out of commits in every repository on that computer.

Apiiro agrees that works on one machine. Its objection is that the rule lives in one person's git settings and never goes into the project's own `.gitignore`. In the researchers' words, "nothing travels with the project to protect it."

The protection also does not cover a file already committed, a clone on another computer, or a folder turned into a repository after the file was created.

Apiiro says Claude itself often does the committing. In 539 of the 1,105 repositories with a real secret that it traced, a commit co-authored by Claude changed the file. The firm says it reproduced the behavior with Opus 5.5 and Fable 5.1, and states: "This is Claude Code's own behavior, not the model's."

There is a personal-responsibility side to this. Someone has to click the permanent approval, and someone has to push the file to a public repository. Apiiro's point is that the tool is designed so that one careless habit can produce both results.

Scanners missed a lot

Apiiro ran two common secret scanners over all 104,185 files. Of the 1,122 files with a real secret, Gitleaks flagged 564 and TruffleHog flagged 643. Neither flagged 215.

The reason, per Apiiro: plain passwords that follow `PGPASSWORD=`, `sshpass -p` or `mysql -p` often lack the recognizable prefixes that scanners key on.

This is not the first warning. A GitHub issue reported plaintext credential storage in approved commands as early as August 2025.

What Apiiro tells developers to do

The advice is to rotate first. Change every password, token and key the file has ever held, then clean up. Deleting the file does not undo the leak, because older versions persist in git history and forks. Apiiro found forks that reproduced credentials from 74 repositories into 211 additional copies, and 734 secrets in historical versions that no longer appear in current files.

After rotating, developers should stop tracking `.claude/settings.local.json` and add an ignore rule inside each repository.

Whether Anthropic changes how Claude Code stores approved commands, or adds the ignore rule to the project itself, is the open question. Apiiro's findings put the cost of the current design at 63 organizations, and at least one live key, so far.