Apiiro finds Claude Code's "don't ask again" approvals left secrets in 1,122 public GitHub files

Application security company Apiiro has published research showing that a convenience feature in Anthropic's Claude Code can end up exposing credentials on GitHub. The findings, based on a snapshot taken on 2 November and released on 5 November, were reported in detail by the tech site MadRobot.

How the leak happens

When Claude Code asks permission to run a shell command, the user can answer "Yes, and don't ask again". Claude Code's own settings documentation confirms that this choice writes the approval as an allow rule into .claude/settings.local.json in the project. Apiiro's point is that the rule contains the full command as typed, so a database password or API token passed on the command line is stored there in plain text.

The documentation says Claude Code adds that file to the user's global git excludes the first time it writes it, so it should stay out of commits. Apiiro argues the safeguard has gaps: it does not cover a folder that only later becomes a repository, a clone on another machine, or a file that was already committed, and the rule is never added to the project's own .gitignore.

What Apiiro found

According to MadRobot's account, Apiiro examined 104,185 public copies of the file and found what it calls real secrets in 1,122 of them, touching 63 organisations. Adding older file versions, the shared .claude/settings.json and saved agent chat logs, the total reached 2,539 secrets in 1,994 repositories. Gitleaks flagged 564 of the 1,122 files, TruffleHog 643, and 215 slipped past both, often plain passwords typed after flags such as mysql -p. Of 16 coding agents compared, Claude Code was the only one confirmed to save the full approved command to a project file by default.

Apiiro did not test whether the credentials worked; "real" means the value matched a key format or pointed to a public host. The company also sells security products.

Response and mitigations

MadRobot reports that Anthropic has not commented. Apiiro cites four user reports on Claude Code's GitHub since August 2025, none answered by Anthropic. Lakera earlier found 428 npm packages shipping the same file, with credentials in 33 files across 30 packages.

Apiiro's advice is to search organisations for both settings files, including git history; rotate any secret they ever held, since deletion does not clean forks or clones; untrack the file and add it to .gitignore; and approve patterns that reference environment variables instead of literal commands.