Claude Code's “Don't ask again” button saves passwords to a file — 2,539 secrets leaked on GitHub

The “Yes, don't ask again” button saves a few seconds, but it could end up costing you your cloud keys. Apiiro researchers discovered that, after receiving this confirmation, Claude Code writes the approved command in full to a settings file. If the command contains secrets, they remain there in plaintext.

How it happens

Imagine asking the agent to connect to a database. It constructs a command such as psql, with the password directly in the connection string, or runs curl with a token in the header. Claude Code asks for permission, you click “Yes, don't ask again,” and, to avoid asking again in the future, the agent saves an allow rule in .claude/settings.local.json. The rule contains the command literally, including the password.

Then ordinary human inattention takes over. The file sits inside the project, a developer runs git add . and git push, and the secret lands in a public repository. The word local in the filename creates a false sense that the file will never leave the machine, but in practice it is often not excluded from the index.

The scale of the problem

Apiiro found 2,539 secrets across 1,994 repositories. They included database passwords, SSH credentials, and AWS keys. This is not a theoretical scenario: these leaks have already occurred, and harvesting bots find this kind of data in public repositories very quickly.

Another problem is that deleting the file in a subsequent commit solves nothing. Git retains the full history, so the secret remains accessible in older commits. The only reliable course is to treat the key as compromised, revoke it immediately, and issue a new one. Cleaning the history with filter-repo is necessary, but only as an additional measure.

What to do right now

• Check your repositories for .claude/settings.local.json and inspect what has been saved in it.
• Add the file to .gitignore, or preferably to the machine's global gitignore.
• Enable pre-commit hooks and secret scanners such as gitleaks, or enable push protection on GitHub.
• Do not pass secrets in commands: use environment variables, secret managers, and AWS profiles.
• If the file has already been published, rotate every key and password listed in it immediately.

Limitations and conclusion

There is no malicious intent on the model's part here. This is a design flaw in a convenience feature: the permission is remembered as a complete command line. The remaining question is how quickly Anthropic will change the behavior—for example, by saving a template without arguments or masking sensitive values. Until that happens, responsibility rests with the team.

For product teams and founders, the broader lesson is that any tool with a “remember my decision” feature creates a new artifact containing sensitive data. It must be included in the threat model alongside logs, dumps, and .env files. We are granting agents increasingly broad access, while hygiene around their settings files is lagging behind. Spend ten minutes on an audit today, before someone else does it for you.