Claude Code Approvals Exposed 2,539 Secrets

Passwords, API keys and database logins that developers approved inside Anthropic's Claude Code are sitting in public GitHub repositories, application security firm Apiiro said in research published Nov. 5. The leak comes from the coding agent's "Yes, and don't ask again" option, which can save an approved shell command word for word, secret included.

Apiiro researchers Shmulik Cohen and Matan Giladi counted 2,539 distinct secrets across 1,994 public repositories. The findings were reported Nov. 7 by The Hacker News and iTWire.

Key takeaways

• Apiiro found at least one secret in 1,122 of 104,185 public copies of the .claude/settings.local.json file, about 1.1%.
• Exposed values include 379 database passwords, 43 SSH logins, 42 GitHub, GitLab and npm tokens, and 23 AWS keys.
• Apiiro did not test whether the credentials work. One notified company confirmed its exposed key had been live.

How Claude Code's "don't ask again" saves secrets

Claude Code asks before running most shell commands. Its permissions documentation says that choosing "Yes, and don't ask again" for a Bash command saves an allow rule to .claude/settings.local.json at the repository root, so matching commands run without asking later.

When the saved rule is one exact command rather than a pattern, any password or token typed into it is stored in plain text. If the file is committed and pushed, the secret goes public with it.

Anthropic's settings documentation says Claude Code adds the file to the user's global git excludes the first time it writes it. Apiiro says that protection lives on one developer's machine, does not travel with the project's own .gitignore and does nothing for a file already tracked by git.

What Apiiro found on GitHub

Apiiro collected public GitHub data from Nov. 1 to Nov. 3. The 1,122 files with secrets held 1,379 distinct values, and more than a third of them open a database directly. Owners include 63 organizations.

Half of the affected files had sat on their repository's default branch for at least 217 days. Older versions in git history held 734 more secrets across 509 repositories, and 211 forks of 74 repositories carried the same secrets.

The 2,539 total also counts the shared .claude/settings.json file, where 298 of 76,011 copies held secrets, plus saved agent chat logs. In 539 of 1,105 repositories the researchers traced, a commit listing Claude as co-author changed the local file.

Common scanners missed many cases. Of the 1,122 files, gitleaks flagged 564 and TruffleHog 643, while 215 were caught by neither. Most misses were passwords typed inside commands.

Context: an old bug report

The behavior was reported before. A Claude Code GitHub issue filed Aug. 11, 2025 said approved commands with credentials were stored verbatim in the file. It was automatically closed as "not planned" after inactivity.

The researchers say four related reports were all closed by the same bot without a reply from Anthropic. Of 16 coding agents whose documentation Apiiro compared, Claude Code was the only one confirmed to save the full approved command in a project file by default. Apiiro sells security products for AI coding agents.

What's next for developers

Apiiro's advice is to rotate first: change every password, token and key the files ever held, because deleting the file does not erase git history or forks. Developers can then run git rm --cached on the local file and add it to the repository's .gitignore.

The researchers also recommend referencing secrets as variables, approving command patterns instead of single commands, and scanning agent folders such as .claude/ for secrets.

FAQ

Am I affected if I never committed the file?

Your secrets are not on GitHub, but the file still holds them in plain text on disk. Apiiro advises opening it and deleting any rule that contains a secret.

Were the leaked credentials used by attackers?

Apiiro did not test the credentials and does not say whether anyone used them. One notified company confirmed its key had been live.

References

• Configure permissions - Claude Code Docs — Anthropic
• Settings files and precedence - Claude Code Docs — Anthropic
• [BUG] approved bash commands containing credentials are stored as is with plain text credentials in settings.local.json #5544 — GitHub (Aug. 11, 2025)
• Claude Code's "Don't Ask Again" File Exposes Passwords and Keys in 1,122 Public Copies on GitHub — The Hacker News (Nov. 7, 2026)
• Claude Code approval files found exposing company secrets on GitHub, says Apirro researchers — iTWire (Nov. 7, 2026)