Claude Code permission file exposes secrets in 1,122 public GitHub copies
Original title: Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Apiiro found 1,379 secrets, including database passwords and AWS keys; one notified company confirmed a live key.
Choosing "Yes, and don't ask again" in Anthropic's Claude Code can save the approved shell command, including a typed password or token, in plaintext in .claude/settings.local.json. Apiiro said 1,122 of 104,185 public copies of that file hold at least one secret, and git history and forks keep older copies after deletion. Claude Code adds the file to a user's global git excludes, not the project's .gitignore, so the protection does not travel with the repo. Researchers advise rotating every secret the files have held before cleanup.
Unconfirmed: Apiiro did not test whether the secrets still work, and it does not say whether anyone used them; one notified company confirmed its key was live.
- The 1,122 files hold 1,379 secrets, including 379 database passwords and 23 AWS keys.
- Older file versions add 734 secrets across 509 repositories no longer in current copies.
- As of Monday, every secret-bearing file was still on the default branch.
- In half of those repositories the file had been present for at least 217 days.
- Of 16 coding agents compared, only Claude Code saves the full approved command by default.
Impact: Plaintext passwords, tokens, and cloud keys in public repos
| Product | Affected |
|---|---|
| Anthropic Claude Code | — |
- 1.Search organizations for .claude/settings.local.json and .claude/settings.json, including git history.
- 2.Rotate every password, token, and key those files have ever held before cleanup.
- 3.Stop tracking the local file and add it to the repository .gitignore.
- Vendors
- Anthropic
- Products
- Claude Code
- Organizations
- Apiiro
From the original article
5 min read at thehackernews.com
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.