Claude Code’s ‘don’t ask again’ button leaked 2,539 real secrets
No attacker needed. No phishing email. Just a developer clicking “Yes, and don’t ask again” inside Claude Code, and a settings file that quietly found its way into a public GitHub repository.
Application security firm Apiiro published research identifying 2,539 real secrets across 1,994 public GitHub repositories. The exposed material spans database passwords, cloud access keys, API tokens, and SSH credentials. Sixty-three organisations were affected, from startups and software agencies to established technology vendors. Some credentials had been publicly accessible for months. A few had been sitting there for more than a year.
How the settings file becomes a liability
When Claude Code suggests a command that includes a credential, it asks for permission to run it. If the developer clicks “Yes, and don’t ask again,” the approval gets saved to a local settings file. The catch: that saved rule can contain the full command, password included.
Claude Code is designed to keep that file on the developer’s machine and tries to protect it via the global Git ignore configuration. That protection has gaps. If the project becomes a repository, if the file gets moved to another machine, or if it’s already tracked by Git, the settings file can end up in the codebase. If the repository is public, so are the credentials. In some cases, the AI assistant itself committed the file as part of a routine code change.
What Apiiro found in 104,000 files
Apiiro examined more than 104,000 publicly accessible copies of Claude Code’s local settings file on GitHub. Of these, 1,122 contained real secrets, amounting to 1,379 distinct credentials: 636 provider keys and 743 passwords or tokens tied to publicly accessible hosts.
- 379 database passwords
- 122 Supabase service-role keys
- AWS keys, GitHub and GitLab tokens, npm tokens
- Private SSH keys
- 43 SSH credentials for public servers, some with root-level access
Deleting the file does not close the exposure. Apiiro found 734 additional real secrets in earlier versions of files that no longer existed in current repositories, still retrievable from Git history. Another 211 forks of 74 affected repositories carried the same exposed secrets.
Secret scanners are missing some of this
Most secret scanners look for recognisable patterns: cloud-provider key formats, token structures, strings that resemble passwords. Credentials buried inside ordinary command lines, such as a database password inside a connection string or an SSH password in a remote login command, may not match those patterns.
Apiiro tested two widely used scanners against the 1,122 files known to contain real secrets. Gitleaks flagged 564 files. TruffleHog flagged 643. 215 files containing real secrets were missed by both.
Anthropic’s response
Boris Cherny, Anthropic’s Head of Claude Code, responded in the Hacker News discussion on 7 November. He acknowledged the company was looking at preventing such exposures, including improvements to automatic approval modes and built-in secret scanning. He also accepted that sensitive commands could still trigger similar issues even when automatic approval modes are used. The proposed safeguards were still at the prototyping stage at the time of his response.
What to do now
Apiiro’s recommendations for teams using Claude Code or similar agents:
- Treat AI agent configuration folders and memory files as sensitive assets, on the same level as environment files and credential stores.
- Add project-level Git ignore rules that explicitly exclude local agent settings files.
- Add pre-commit checks and CI pipeline steps that examine AI-generated configuration files and repository histories.
- Stop typing passwords and API keys directly into command lines. Use environment variables or an approved secrets-management platform instead.
- If a credential has already appeared in a public repository, revoke or rotate it immediately. Deleting the file or rewriting Git history does not guarantee safety. Start with credentials tied to publicly accessible systems.
The research focused on Claude Code but Apiiro notes the concern applies across AI-assisted development tools including GitHub Copilot and Cursor. Any agent that executes commands, reaches into systems, and saves its working context is operating on the same sensitive surface.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
