Claude Code's 'Don't Ask Again' Button Leaked 1,379 Credentials Across 1,122 Public GitHub Repos

Quick Facts

• Security firm Apiiro found 1,379 distinct credentials exposed in 1,122 public GitHub files linked to Claude Code's settings behavior.
• Exposed secrets included 379 database passwords, 43 SSH logins, 42 tokens for GitHub, GitLab, and npm, and 23 AWS keys.
• Anthropic's head of Claude Code acknowledged the issue on Hacker News but said no fix had shipped as of the November 9 release of version 2.1.321.

A convenience feature inside Anthropic's Claude Code has quietly deposited passwords, API keys, and database credentials into plain-text files that thousands of developers then pushed to public GitHub repositories, according to research published by software security firm Apiiro.

Every time Claude Code wants to run a terminal command, it prompts the developer for permission. When a developer clicks "Yes, and don't ask again," Claude Code writes the approved command, including any embedded secrets, verbatim into a local project file called .claude/settings.local.json. That file then becomes one careless git add away from the open web.

What Apiiro Found

Apiiro researchers Shmulik Cohen and Matan Giladi scanned 104,185 public copies of local Claude Code settings files across 103,617 GitHub repositories. About 1.1% held real secrets. When researchers checked earlier commits, shared settings files, and agent transcripts, the total credential count reached 2,539.

The exposed credentials traced back to 63 organizations, most of them software companies. The breakdown included 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab, and npm, 23 AWS keys, and 122 Supabase service-role keys. Some SSH commands contained root passwords.

High-value targets included a database vendor's own admin-level cloud key, a production Azure Postgres password, a Square production token, and the owner password of a medical-records database, according to Apiiro's report. Claude co-authored commits exposing real secrets in 539 of 1,105 affected repositories. The median leaking repository had its file first committed 217 days before Apiiro's November 2 snapshot.

A Scanner Blind Spot

Standard security tooling missed a significant portion of the leaks. Apiiro found that two popular scanners, Gitleaks and TruffleHog, failed to flag 215 of the 1,122 files containing secrets. Passwords embedded after flags like PGPASSWORD=, sshpass -p, or inside request headers often lack the structured formats those tools use to identify provider-issued keys.

Apiiro also found secrets in 298 of 76,011 public copies of the shared .claude/settings.json file, a separate file that development teams commit deliberately as part of their workflow.

Anthropic's Response

Boris Cherny, Anthropic's head of Claude Code, addressed the issue on Hacker News after Apiiro notified the 63 affected organizations on November 6. The post drew 514 points and 376 comments.

"Historically Claude Code has not done secret scrubbing," Cherny wrote, "but we are looking into what we can do to prevent this." He added that .claude/settings.local.json "is meant to stay local" and that Anthropic automatically adds it to .gitignore when Claude creates the file. "In this case the files were manually created and checked in," he said.

Cherny said the team is prototyping fixes including making sure auto mode catches the issue and building in basic secret scanning. As of the 2.1.321 release on November 9, no fix had shipped.

The Issue Was Flagged More Than a Year Ago

Claude Code users filed a bug report about the behavior on August 11, 2025. An automated bot closed that report as "not planned" on January 3, 2026, after 60 days without activity. Three more bug reports followed.

The threat was already on attackers' radar. The Shai-Hulud npm worm ran TruffleHog over victims' files in September 2025, hunting for exactly this type of credential. In April 2026, Check Point-owned Lakera found credentials in 33 Claude Code settings files across 30 packages published to the npm registry.

What Founders Should Do Now

Apiiro confirmed that at least one organization it notified had an exposed key that was still live at the time of contact. Researchers did not test whether other credentials remained active, and no abuse has been publicly reported.

Cherny recommended that developers enable secret scanning on GitHub regardless of which coding agent they use. Teams running Claude Code should audit their repositories for committed copies of .claude/settings.local.json and .claude/settings.json, rotate any credentials found in those files, and confirm both files are listed in .gitignore before the next commit.