Claude Code's “don't ask again” settings file holds passwords and keys in 1,122 public GitHub copies, Apiiro's research finds, two outlets report

Apiiro, a software security company, searched public GitHub for copies of Claude Code's local settings file, The Hacker News and Cybersecurity News reported on 7 November. Apiiro's own write-up refused this run twice, so the figures here are the two outlets'.

The cause, as The Hacker News explains it: when a user picks “Yes, and don't ask again” for a command, Claude Code saves an allow rule in .claude/settings.local.json inside the project, so a command that contains a password or key is written into that file. If the file is committed, the secret goes with it.

Apiiro found 104,185 copies of the file in 103,617 repositories, The Hacker News reports. Both outlets report that 1,122 copies hold at least one secret, with 1,379 different secrets between them. Counting the shared .claude/settings.json file, older versions of the file and saved agent chat logs, both give 2,539 secrets across 1,994 repositories.

The researchers say they reproduced the behaviour with Opus 5.5 and Fable 5.1, and that earlier related bug reports got no reply from Anthropic, The Hacker News reports. Neither article carries a statement from Anthropic.

Anyone who uses Claude Code can check that file before pushing a project, keep it out of version control, and rotate any key that has already been published.

• Reported Apiiro found 104,185 copies of the file in 103,617 repositories; 1,122 hold a secret, with 1,379 different secrets, The Hacker News reports. The Hacker News
• Reported Cybersecurity News reports the same 1,122 files and 1,379 credentials, and 2,539 secrets across 1,994 repositories once earlier commits, shared settings files and agent transcripts are counted. Cybersecurity News
• Claimed The researchers say they reproduced it with Opus 5.5 and Fable 5.1, and that related bug reports got no reply from Anthropic. The Hacker News, reporting Apiiro