Apiiro: Claude Code 'Don't Ask Again' Leaks Keys in 1,122 Repos

Passwords and API keys developers typed into commands they approved inside Claude Code are sitting in public GitHub repositories, according to a report from software security company Apiiro covered by The Hacker News. When a user picks "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word including the secret, into a project settings file at `.claude/settings.local.json` — a path that is not gitignored by default.

Apiiro says it scanned 104,185 public copies of that file across 103,617 repositories. About 1.1% of them, or 1,122 copies, hold at least one secret. Together they hold 1,379 different secrets. The company did not test whether any still work.

The breakdown is specific: 379 database passwords, 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Half of the affected repositories kept the file on their default branch for at least 217 days. Another 734 secrets turned up in older file versions across 509 repositories, deleted from the current tree but still readable in history, and 211 forks carried identical secrets copied from the original. Sixty-three organizations, mostly software companies, are affected. Apiiro notes that gitleaks flagged 564 of the files and TruffleHog detected 643; neither caught 215 of them.

The researchers compared documentation for 16 coding agents. "Claude Code is the only one confirmed to save the full approved command in a project file by default," the report says. That matters because the convenience toggle is the kind of thing a developer clicks once and forgets; the secret then ships to origin with the next commit.

Apiiro also says Anthropic's security intake has been quiet. "As of today, the four related reports the researchers cite have all been closed by the same bot, the most recent yesterday. None got a reply from Anthropic, they say." An earlier report from August was closed as "not planned" on January 3, after 60 days without activity. This is the second Claude Code disclosure we've tracked in a week, following a bug report alleging email leakage in the client's User-Agent header.