Claude Code left secrets in 1,122 public GitHub files because of "Don't ask again"

You ask the agent to call an API, it asks permission to run the command, and you're tired of clicking "Yes" for the tenth time, so you choose "Don't ask again". Convenient. But Qodo found that this button has a side effect: 1,122 public settings files on GitHub contained secrets that Claude Code itself saved there.

How a secret gets into the config

Claude Code has a permissions system. When you agree to "don't ask again" for a specific command, the agent appends a rule to a settings file inside the .claude folder. There is a shared settings.json, which is usually committed along with the project, and a local settings.local.json for personal rules.

The problem is that the rule describes the command literally, with all its arguments. Say you asked the agent to make a request via curl and pasted the token straight into the header. The agent will remember that entire string, and the token ends up in the file in plain text. This is an illustration of the mechanism, not a quote from the report. But the logic is exactly this: you didn't "save" anything, you clicked a convenience button.

Then ordinary human inertia takes over. Someone commits the whole .claude folder because it holds "useful settings for the team". The repository ends up public, and the secret sits in plain view.

Why this is not a minor issue

We're used to secrets leaking from .env files, cloud configs, and hardcoded strings in code. Agent settings files didn't fit that picture: they were seen as "personal editor preferences", like a color theme. But they now hold executable permissions: what the agent may run without asking. So the file has two roles at once: a security policy and a potential store of secrets.

Another point matters even more. These files are written not by a human but by a tool, and in response to a click rather than a conscious decision to "save a config". Nobody rereads what they didn't write themselves. Hence Qodo's conclusion: agent settings must be reviewed like code.

What to do right now

• Check your repositories. Search .claude/ for strings that look like keys, tokens, and passwords, including in git history. Deleting the file in the latest commit is not enough: the history remains.
• Rotate everything you find. If a token was ever in a public repository, consider it compromised.
• Lock down the local file. settings.local.json should be in .gitignore. Don't assume someone has already done it.
• Remove secrets from the commands themselves. Pass them via environment variables or a secrets manager, so the rule contains the variable name, not the value.
• Turn on automation. A secret scanner in pre-commit and CI, plus push protection on GitHub. Add .claude to CODEOWNERS so changes to agent permissions don't bypass review.
• Don't overuse "Don't ask again". For commands with sensitive arguments, it's better to confirm each time or write a narrow rule by hand.

Limitations and caveats

The report was published by Qodo, a vendor of code review tools. The topic is close to home for them, and they present it accordingly. Also, the announcement doesn't show how many of the secrets found were live. And 1,122 files is what turned up in public search, not the full picture: nobody counted private repositories.

The complaint is not about just one product, though. The same "remember the command" mechanism exists in other agent tools, and the same questions apply to them. A reasonable expectation of agent developers: mask or don't store values that look like secrets, and warn before writing.

Bottom line

Agentic tools create a new class of artifacts: configs that write themselves, run with your privileges, and easily end up in git. Treat them as code: review, scanning, .gitignore. It's cheaper than dealing with the consequences of a leaked key.