Claude Code “Don’t Ask Again” Persists Secrets in GitHub Repositories
Original title: Claude Code’s “Don’t Ask Again” Feature Exposes 2,539 Secrets Across 1,994 GitHub Repositories
Apiiro research exposed 2,539 secrets across 1,994 public GitHub repositories via Claude Code configuration files.
Claude Code’s “Yes, and don’t ask again” approval can persist credential-bearing shell commands inside .claude/settings.local.json. Exposed material included production database passwords, cloud credentials, API tokens, and SSH logins, affecting 63 organizations. One organization confirmed its exposed key had been live. The leakage begins when Claude Code proposes a command containing credentials. Approving persistent execution stores the literal command as an allowlist rule rather than stripping its sensitive arguments.
Unconfirmed: Apiiro “real secret” classification indicates credible material but not verified validity
- 2,539 distinct secrets found in 1,994 repositories
- 1,122 files containing 1,379 distinct secrets
- Historical versions contained 734 secrets
- Detection gaps with Gitleaks and TruffleHog
- Apiiro examined 104,185 public .claude/settings.local.json copies
- Vendors
- Claude
- Products
- Claude Code
- Victims
- 63 organizations
- Organizations
- Apiiro
From the original article
2 min read at gbhackers.com
A newly identified 2,539 distinct secrets across 1,994 public GitHub repositories, tracing exposure to coding-agent configuration files, Git history, and saved transcripts. Their November 5 research describes how Claude Code’s “Yes, and don’t ask again” approval can persist credential-bearing shell commands inside . claude/settings.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.