Claude Code Security Risk: How the Don’t Ask Again Feature Leaks Plaintext Credentials to GitHub

Claude Code Settings Files Leak Plaintext Passwords on GitHub

Security researchers at Apiiro discovered that selecting the “Yes, and don’t ask again” option in Anthropic’s Claude Code AI assistant writes command strings containing plaintext credentials directly into project configuration files.

According to Apiiro’s findings published on November 5, 2026, developers routinely commit these files to public GitHub repositories, exposing thousands of database passwords and API keys.

The exposure stems from the default permission persistence mechanism within Claude Code, a terminal-based AI assistant. When a user approves a shell command involving sensitive arguments—such as database logins or cloud provider keys—the assistant saves the exact command string inside a local configuration file named settings.local.json located within the project’s hidden .claude folder.

Scale of the Exposures Across Public Repositories

Apiiro searched publicly available GitHub repositories between November 1 and November 3, 2026, uncovering 104,185 copies of the settings file across 103,617 repositories. Roughly 1.1 percent of those copies—totaling 1,122 files—contained at least one secret, yielding 1,379 distinct secrets.

More than a third of the identified secrets grant direct access to databases, including 379 database passwords and 122 Supabase service-role keys. The exposed data also encompassed 43 SSH logins for public servers, 42 authentication tokens for GitHub, GitLab, and npm, alongside 23 Amazon Web Services keys.

Apiiro traced the compromised configurations to 63 organizations, predominantly software development firms. Among the most severe exposures were a database provider’s cloud-admin key and the owner password for a database containing medical patient records.

Claude Code Safeguards Fail to Prevent Version Control Exposure

Although Claude Code attempts to restrict the file from version control by appending an exclusion rule to the user’s global Git excludes file upon initial creation, that safeguard remains bound to a single local machine. It fails to apply when a folder later becomes a repository, when projects migrate to build servers, or when developers manually generate the file, according to documentation analysis by Apiiro.

Researchers noted that in 539 of the traced repositories, a commit listing Claude as a co-author had modified the settings file, indicating the agent often commits the configuration itself.

Furthermore, an automated bug report filed on August 11, 2025, detailing how API tokens were saved verbatim into settings.local.json, was closed by an automated bot as “not planned” on January 3, 2026. Apiiro reported that four related bug reports were similarly closed by automated systems without a response from Anthropic.

Apiiro recommends auditing all public and private repositories for local configuration files, immediately rotating any exposed credentials, and updating permission rules to reference environment variables rather than hardcoded inline arguments.

Exposed Credentials and Supply-Chain Risk

The exposed secrets include cloud provider API keys for AWS, GCP, and Azure, database passwords and connection strings, third-party SaaS API tokens for services such as OpenAI, Stripe, and Twilio, SSH private key passphrases, and internal service credentials.

Researchers Find Thousands of Secrets in Shared Files

Apiiro stated that this is Claude Code’s own behavior rather than a quirk of a single model, noting that the researchers reproduced the issue with Anthropic’s Opus 5.5 and Fable 5.1. Counting older versions of the file, shared .claude/settings.json files that teams commit intentionally, and saved agent chat logs, Apiiro calculated a total of 2,539 distinct secrets across 1,994 repositories.

The company did not test whether any secret still worked and did not contact the hosts, though one notified organization confirmed its exposed key had been live. When Apiiro ran two popular open-source secret-scanning tools—Gitleaks and TruffleHog—across all copies, Gitleaks flagged 564 of the 1,122 files and TruffleHog flagged 643, while 215 slipped past both.