Claude Code’s “Yes, and don’t ask again” button can save the exact command you approved, password included, into .claude/settings.local.json inside your project. Security firm Apiiro found 1,122 public GitHub copies of that file holding at least one real secret, 1,379 distinct credentials in total. If you use Claude Code, check that file on every machine and repo, rotate anything sensitive it ever held, then add it to the project’s own .gitignore.
Key points
- Approving a command with “Yes, and don’t ask again” writes an allow rule to
.claude/settings.local.json. When the rule is the exact command, any inline password or token is stored in plain text. - Apiiro found 104,185 public copies of the file; 1,122 (about 1.1%) contain secrets, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys.
- Claude Code only adds the file to your global git excludes on one machine, never to the repo’s
.gitignore. In 539 of 1,105 traced repos, a Claude co-authored commit changed the file. - Deleting the file does not fix it: 734 more secrets sit in git history and 211 forks carry copies.
- Common scanners miss many of these: gitleaks flagged 564 files and TruffleHog 643; 215 were caught by neither.
- Apiiro did not test whether the credentials work, so this is an exposure finding, not a confirmed breach.
How does a password end up in settings.local.json?
By default Claude Code asks before running most shell commands. Pick “Yes, and don’t ask again” and it saves a permission rule so matching commands run silently in later sessions. Anthropic’s permissions docs say that rule lives in .claude/settings.local.json at the repository root.
The rule is whatever the prompt offered. Sometimes that is a safe pattern like Bash(npm test:*). Sometimes it is the full command you just approved, such as a psql call with PGPASSWORD=..., a mysql -p... login, an sshpass -p connection, or a curl with a bearer token. In that case the secret is saved word for word. Apiiro says it reproduced the behavior with current models, including Opus 5.5, and that it comes from Claude Code itself rather than the model.
Why does the file end up on GitHub?
Claude Code does try to keep the file out of git. The first time it writes it in a repo, it adds **/.claude/settings.local.json to your global git excludes. That protects one user on one computer. It does not cover a fresh clone on another machine, a folder that becomes a repo later, or a file someone already committed, because the rule never lands in the project’s own .gitignore.
The agent itself is part of the problem. In 539 of the 1,105 repos Apiiro traced, a commit co-authored by Claude changed the file, which usually means a broad git add . swept it in. Every file with a secret was still on its default branch when Apiiro checked, and in half of those repos it had been there for at least 217 days.
What exactly did Apiiro find?
| Finding | Number |
|---|---|
Public copies of .claude/settings.local.json |
104,185 in 103,617 repos |
| Copies holding at least one secret | 1,122 (about 1.1%) |
| Distinct secrets in those copies | 1,379 |
| Database passwords | 379 |
| SSH logins for public servers | 43 |
| GitHub, GitLab and npm tokens | 42 |
| AWS keys | 23 |
| Extra secrets only in git history | 734 across 509 repos |
| Forks carrying the same secrets | 211 forks of 74 repos |
| Total including shared settings.json and agent logs | 2,539 secrets in 1,994 repos |
Bigger files leaked more: about one in ten files over 8 KB held a secret, which tracks with how long someone has been clicking “don’t ask again.” Apiiro also reports that 63 organizations are affected, mostly software companies, and that one company it notified confirmed its key had been live. Of 16 coding agents whose docs it compared, Claude Code was the only one confirmed to save the full approved command to a project file by default.
What has Anthropic said?
A Claude Code team member replied on Hacker News that settings.local.json is meant to stay local and should not be committed, that Claude Code has not historically scrubbed secrets, and that the team is “looking into what we can do to prevent this.” He also pointed users toward auto mode instead of hand-approved permission rules. Apiiro says four earlier bug reports about the same behavior, the oldest more than a year old, were closed by an automated bot without a reply from Anthropic.
The debate in the thread splits two ways. One side says users leaked their own secrets by committing a local file. The other says a single click should not write a plaintext password into a project folder that agents routinely git add. Both can be true, and neither changes what you should do today.
How do you check and fix your own setup?
- Find every local copy. Run
find ~ -path '*/.claude/settings.local.json' 2>/dev/nulland read each file’sallowlist for passwords, tokens, keys or connection strings. - Search your repos and their history. Look for
.claude/settings.local.jsonand.claude/settings.jsonacross your GitHub org, then check history withgit log --all -- .claude/settings.local.jsoneven where the file is gone. - Rotate first, clean up second. Change every password and revoke every token the file has ever held. Rewriting history does not reach forks or clones people already have.
- Stop tracking it in the project. Run
git rm --cached .claude/settings.local.jsonand add.claude/settings.local.jsonto the repo’s own.gitignore, so the protection travels with the code. - Check why git ignores it today.
git check-ignore -v .claude/settings.local.jsonshows whether it is ignored only by your global excludes or not at all. - Keep secrets out of commands. Reference environment variables such as
$DB_URLfrom a secrets manager, so a saved rule stores the variable name, not the value. - Approve patterns, not single commands. Prefer rules like
Bash(npm run:*)over one-off commands that carry credentials.
What should teams change beyond Claude Code?
- Treat agent folders such as
.claude/,.cursor/,.gemini/and.specstory/like.envfiles, on laptops and in repos. - Add them to pre-commit and CI secret scanning, including history, and tune scanners to catch passwords inside commands, not only known key formats.
- Put
.claude/settings.local.jsonin your organization’s.gitignoretemplates. - Tell agents to stage named files instead of running
git add ., and enforce it with a hook if they keep ignoring the instruction. - Prioritize rotating credentials paired with a public server address, since those are the ones that actually grant access.
What should you watch next?
- Whether Anthropic ships secret scrubbing for saved permission rules or writes the file to the project’s
.gitignoreby default. - Whether GitHub secret scanning and tools like gitleaks and TruffleHog add rules for agent config folders.
- Similar audits of other agents’ local config and transcript files, which Apiiro’s counts suggest are already leaking.
